Staff Security Engineer, Product Security

Flexport•San Francisco, CA

3d•$221,484 - $270,703•Onsite

About The Position

Flexport is hiring a Staff Security Engineer to define and scale product security across its products, services, and global infrastructure. The role sets security architecture, patterns, and reference implementations that make secure-by-default development easier, and leads security reviews and threat modeling for high-risk product areas. The engineer will establish approaches for vulnerability triage and remediation, own security services and tooling used by product teams, and scale security practices through a champions program and training. The position also provides technical mentorship and serves as an authoritative product security voice across engineering leadership. It is based in San Francisco, with a strong preference for candidates who are there or willing to relocate; relocation support is available for the right candidate. Flexport describes its work approach as collaborative, regularly using the San Francisco office, and coordinating with international teammates through Slack, video, and asynchronous documents.

Requirements

Typically 8 or more years of experience in product or application security; hands-on experience building security tools and services is valued more than the exact number of years.
Track record designing security architecture that scales across many teams and services.
Strong understanding of web application security principles.
Hands-on experience with application testing tools such as Burp Suite, OWASP ZAP, or similar.
Software development experience building security tools in at least one modern language, such as Go, Python, Java/Kotlin, TypeScript, Ruby, or similar.
Track record leading multi-team technical initiatives and mentoring engineers into senior roles.

Nice To Haves

Experience running or scaling a security champions program.
Identity management and identity federation experience, including SAML, OAuth, or SCIM.
Experience with IaaS cloud infrastructure, Kubernetes, containers, and service-oriented architectures.
Hands-on experience with bug bounty platforms and SAST tools such as Cycode, Semgrep, Snyk, or similar.
Experience performing code audits on internal or open-source libraries before they ship in production.

Responsibilities

Define security architecture for Flexport products and services, and establish patterns and reference implementations for secure-by-default development.
Lead security engineering reviews for the highest-risk product features and set quality standards for reviews conducted by others.
Build and scale the security champions program and product security training.
Lead domain-specific threat modeling and attack surface analysis across Flexport's product surface.
Partner with engineering leadership to resolve security design tradeoffs.
Establish standards for triaging, reproducing, and prioritizing bug bounty submissions and internal security reports, and handle the most difficult or severe cases.
Drive remediation of systemic vulnerability classes.
Own security services and tooling used by product teams across global infrastructure.
Mentor security engineers and serve as the authoritative technical voice on product security across engineering leadership.