Security Engineer, Product Security

Title: Security Engineer, Product Security Location: U.S. Remote

What You'll Do

• Architecture & strategy
  • Define security architecture for Flexport's products and services, and set the patterns and reference implementations that make secure-by-default the path of least resistance.
  • Lead security engineering reviews for the highest-risk product features, and set the bar for what "good" looks like in reviews you don't personally run.
  • Build and scale the security champions program and product security training that extend your judgment into teams where you can't be in every review.
• Design-time & review
  • Lead domain-specific threat modeling and attack surface analysis across Flexport's product surface, not just individual features.
  • Partner with engineering leadership to resolve the design tradeoffs that a senior engineer would escalate.
• Vulnerability management
  • Set the bar for how the team triages, reproduces, and prioritizes bug bounty submissions and internal security reports, and step in on the hardest or highest-severity cases.
  • Drive remediation of systemic classes of vulnerability, not just individual findings.
• Developer enablement & leadership
  • Own the security services and tooling consumed by product teams across our global infrastructure.
  • Mentor other engineers on the team, and act as the authoritative technical voice on product security across engineering leadership.

You Should Have

• Typically 2–5 years of experience in product/application security or software development with a security focus — we care more about what you've built than the exact number. If you meet most of this, apply; we'd rather see your work than filter you out on a résumé line.
• Strong grasp of web application security principles and common attack vectors (e.g., OWASP Top 10)
• Proficiency with application testing tools such as Burp Suite, OWASP ZAP, or browser developer tools
• Working knowledge of at least one modern programming language (e.g., Ruby, Java/Kotlin, TypeScript/JavaScript, Python) and at least one major cloud provider (AWS, GCP, Azure)
• Comfortable with security on-call rotation and picking up work across security disciplines when needed

Nice to Have

• Hands-on experience with bug bounty platforms
• Hands-on experience with SAST tools (Cycode, Semgrep, Snyk, or similar)
• Experience with cloud infrastructure security and container technologies
• Participation in CTF events or open-source security projects
• Familiarity with threat modeling frameworks and secure SDLC best practices
• Interest in contributing to internal developer security training programs

How We Work

• We stay closely aligned with teammates on other continents via Slack, video, and async docs
• We have the latest hardware and software, including frontier AI models on day one
• We're agile, but not dogmatic — the team decides how it works best

Why This Role Is Special

• Massive leverage: the conventions and champions program you build are multiplied across hundreds of engineers who never talk to you directly.
• Broad authority: you set the architecture other reviews are measured against, rather than being the one measured.
• You're part of PSI: the platform, security, and infrastructure teams work hand in hand, and security is treated as infrastructure with real engineering quality bars, not a policy function.

#LI-VA1