# Security Engineer, Product Security

**Company**: Flexport
**Location**: U.S. Remote
**Work arrangement**: remote
**Experience**: senior
**Job type**: full-time
**Salary**: California $130,950-$202,125 USD, Washington $147,000-$183,750 USD, Colorado $148,210-$163,688 USD, New York City $147,000-$183,750 USD, Illinois $148,210-$163,688 USD
**Category**: Security
**Industry**: Technology

**Apply**: https://job-boards.greenhouse.io/flexport/jobs/8375181?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply
**Canonical**: https://yubhub.co/job/security-engineer-product-security-ab784ffb-da9/

## Description

## Job Overview

We are seeking a Security Engineer, Product Security to join our Engineering, Security department. As a Security Engineer, you will define security architecture for Flexport's products and services, lead security engineering reviews, and drive remediation of systemic classes of vulnerability.

## Responsibilities

### Architecture & Strategy

- Define security architecture for Flexport's products and services, setting patterns and reference implementations for secure-by-default.

- Lead security engineering reviews for high-risk product features, setting the bar for what "good" looks like.

- Build and scale the security champions program and product security training.

### Design-time & Review

- Lead domain-specific threat modeling and attack surface analysis across Flexport's product surface.

- Partner with engineering leadership to resolve design tradeoffs escalated by senior engineers.

### Vulnerability Management

- Set the bar for triaging, reproducing, and prioritizing bug bounty submissions and internal security reports.

- Drive remediation of systemic classes of vulnerability.

### Developer Enablement & Leadership

- Own security services and tooling consumed by product teams across the global infrastructure.

- Mentor other engineers on the team and act as the authoritative technical voice on product security.

## Requirements

- Typically 2–5 years of experience in product/application security or software development with a security focus.

- Strong grasp of web application security principles and common attack vectors (e.g., OWASP Top 10).

- Proficiency with application testing tools such as Burp Suite, OWASP ZAP, or browser developer tools.

- Working knowledge of at least one modern programming language (e.g., Ruby, Java/Kotlin, TypeScript/JavaScript, Python) and at least one major cloud provider (AWS, GCP, Azure).

- Comfortable with security on-call rotation and picking up work across security disciplines when needed.

## Nice to Have

- Hands-on experience with bug bounty platforms.

- Hands-on experience with SAST tools (Cycode, Semgrep, Snyk, or similar).

- Experience with cloud infrastructure security and container technologies.

- Participation in CTF events or open-source security projects.

- Familiarity with threat modeling frameworks and secure SDLC best practices.

- Interest in contributing to internal developer security training programs.

## What We Offer

- Competitive salary: California $130,950-$202,125 USD, Washington $147,000-$183,750 USD, Colorado $148,210-$163,688 USD, New York City $147,000-$183,750 USD, Illinois $148,210-$163,688 USD.

- Comprehensive benefits package including bonus, equity, medical, dental, and flexible time off.

For more fresh new jobs, check out [yubhub.co](https://yubhub.co/).

## Skills

### Required
- web application security
- OWASP Top 10
- Burp Suite
- OWASP ZAP
- Ruby
- Java/Kotlin
- TypeScript/JavaScript
- Python
- AWS
- GCP
- Azure

### Nice to have
- bug bounty platforms
- SAST tools
- cloud infrastructure security
- container technologies
- CTF events
- open-source security projects
- threat modeling frameworks
- secure SDLC best practices

---

Source: [Apply at job-boards.greenhouse.io](https://job-boards.greenhouse.io/flexport/jobs/8375181?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)