Staff Security Engineer, Product Security

What You'll Do

• Architecture & strategy
  • Define security architecture for Flexport's products and services, and set the patterns and reference implementations that make secure-by-default the path of least resistance.
  • Lead security engineering reviews for the highest-risk product features, and set the bar for what "good" looks like in reviews you don't personally run.
  • Build and scale the security champions program and product security training that extend your judgment into teams where you can't be in every review.
• Design-time & review
  • Lead domain-specific threat modeling and attack surface analysis across Flexport's product surface, not just individual features.
  • Partner with engineering leadership to resolve the design tradeoffs that a senior engineer would escalate.
• Vulnerability management
  • Set the bar for how the team triages, reproduces, and prioritizes bug bounty submissions and internal security reports, and step in on the hardest or highest-severity cases.
  • Drive remediation of systemic classes of vulnerability, not just individual findings.
• Developer enablement & leadership
  • Own the security services and tooling consumed by product teams across our global infrastructure.
  • Mentor other engineers on the team, and act as the authoritative technical voice on product security across engineering leadership.

You Should Have

• Typically 8+ years of experience in product/application security, with real hands-on time building security tools and services, not just reviewing them — we care more about what you've built than the exact number.
• A track record of designing security architecture that scales across many teams and services, not just securing a single product.
• Strong grasp of web application security principles and hands-on experience with application testing tools (Burp Suite, OWASP ZAP, or similar)
• Software development experience building security tools in at least one modern language (Go, Python, Java/Kotlin, TypeScript, Ruby, or similar)
• Track record of leading multi-team technical initiatives and mentoring engineers into senior roles

Nice to Have

• Experience running or scaling a security champions program
• Identity management and identity federation experience (SAML, OAuth, SCIM)
• Experience with IaaS cloud infrastructure, Kubernetes, containers, and service-oriented architectures
• Hands-on experience with bug bounty platforms and SAST tools (Cycode, Semgrep, Snyk, or similar)
• Experience performing code audits on internal or open-source libraries before they ship in production

How We Work

• We stay closely aligned with teammates on other continents via Slack, video, and async docs
• We have the latest hardware and software, including frontier AI models on day one
• We're agile, but not dogmatic — the team decides how it works best

Why This Role Is Special

• Massive leverage: the conventions and champions program you build are multiplied across hundreds of engineers who never talk to you directly.
• Broad authority: you set the architecture other reviews are measured against, rather than being the one measured.
• You're part of PSI: the platform, security, and infrastructure teams work hand in hand, and security is treated as infrastructure with real engineering quality bars, not a policy function.

#LI-Remote

#LI-VA1