Security Engineer, Product Security

Job Overview

As a Security Engineer in the Product Security team at Flexport, you will define and implement security architecture for Flexport's products and services. You will lead security engineering reviews, build and scale the security champions program, and drive vulnerability management.

Responsibilities

Architecture & Strategy

• Define security architecture for Flexport's products and services, setting patterns and reference implementations for secure-by-default.
• Lead security engineering reviews for high-risk product features, setting the bar for what "good" looks like.
• Build and scale the security champions program and product security training.

Design-Time & Review

• Lead domain-specific threat modeling and attack surface analysis across Flexport's product surface.
• Partner with engineering leadership to resolve design trade-offs.

Vulnerability Management

• Set the bar for triaging, reproducing, and prioritizing bug bounty submissions and internal security reports.
• Drive remediation of systemic classes of vulnerability.

Developer Enablement & Leadership

• Own security services and tooling consumed by product teams.
• Mentor other engineers and act as the authoritative technical voice on product security.

Requirements

• 2–5 years of experience in product/application security or software development with a security focus.
• Strong grasp of web application security principles and common attack vectors.
• Proficiency with application testing tools such as Burp Suite, OWASP ZAP, or browser developer tools.
• Working knowledge of at least one modern programming language and one major cloud provider.
• Comfortable with security on-call rotation and picking up work across security disciplines.

Nice to Have

• Hands-on experience with bug bounty platforms.
• Experience with SAST tools.
• Cloud infrastructure security and container technologies experience.
• Participation in CTF events or open-source security projects.
• Familiarity with threat modeling frameworks and secure SDLC best practices.

What We Offer

• Competitive salary: $165,375-$202,125 USD per year.
• Opportunity to work in San Francisco office.
• Latest hardware and software.
• Agile work environment.

Why This Role Is Special

• Massive leverage across hundreds of engineers.
• Broad authority in setting security architecture.
• Part of PSI: platform, security, and infrastructure teams work together.