Security Engineer, Product Security

Job Overview

We are seeking a Security Engineer, Product Security to join our Engineering, Security department. As a Security Engineer, you will define security architecture for Flexport's products and services, lead security engineering reviews, and drive remediation of systemic classes of vulnerability.

Responsibilities

Architecture & Strategy

• Define security architecture for Flexport's products and services, setting patterns and reference implementations for secure-by-default.
• Lead security engineering reviews for high-risk product features, setting the bar for what "good" looks like.
• Build and scale the security champions program and product security training.

Design-time & Review

• Lead domain-specific threat modeling and attack surface analysis across Flexport's product surface.
• Partner with engineering leadership to resolve design tradeoffs escalated by senior engineers.

Vulnerability Management

• Set the bar for triaging, reproducing, and prioritizing bug bounty submissions and internal security reports.
• Drive remediation of systemic classes of vulnerability.

Developer Enablement & Leadership

• Own security services and tooling consumed by product teams across the global infrastructure.
• Mentor other engineers on the team and act as the authoritative technical voice on product security.

Requirements

• Typically 2–5 years of experience in product/application security or software development with a security focus.
• Strong grasp of web application security principles and common attack vectors (e.g., OWASP Top 10).
• Proficiency with application testing tools such as Burp Suite, OWASP ZAP, or browser developer tools.
• Working knowledge of at least one modern programming language (e.g., Ruby, Java/Kotlin, TypeScript/JavaScript, Python) and at least one major cloud provider (AWS, GCP, Azure).
• Comfortable with security on-call rotation and picking up work across security disciplines when needed.

Nice to Have

• Hands-on experience with bug bounty platforms.
• Hands-on experience with SAST tools (Cycode, Semgrep, Snyk, or similar).
• Experience with cloud infrastructure security and container technologies.
• Participation in CTF events or open-source security projects.
• Familiarity with threat modeling frameworks and secure SDLC best practices.
• Interest in contributing to internal developer security training programs.

What We Offer

• Competitive salary: California $130,950-$202,125 USD, Washington $147,000-$183,750 USD, Colorado $148,210-$163,688 USD, New York City $147,000-$183,750 USD, Illinois $148,210-$163,688 USD.
• Comprehensive benefits package including bonus, equity, medical, dental, and flexible time off.