Staff Security Engineer, Product Security

Flexport

3d•$148,210 - $270,703•Remote

About The Position

Flexport is hiring a Staff Security Engineer for Product Security to define security architecture and secure-by-default patterns for its products and services. The role leads security reviews for high-risk product features, establishes review standards, and extends product-security expertise across engineering through security champions and training. The engineer leads threat modeling and attack-surface analysis across Flexport’s products, partners with engineering leadership on difficult design tradeoffs, and sets standards for triaging and prioritizing bug bounty submissions and internal security reports. The role also drives remediation of systemic vulnerability classes, owns security services and tooling used by product teams, mentors engineers, and serves as a technical authority on product security across engineering leadership. Flexport’s teams coordinate across continents using Slack, video, and asynchronous documentation. The company describes its working style as agile but not dogmatic and provides current hardware and software, including frontier AI models. The role is part of the platform, security, and infrastructure organization, where security is treated as an engineering discipline. The position is marked remote. Compensation varies by location, with posted base-salary ranges of $148,210–$270,703 in California; $196,875–$270,703 in Washington and New York City; and $148,210–$185,263 in Colorado and Illinois. Total rewards also include bonus, equity, and comprehensive benefits such as medical, dental, and flexible time off.

Requirements

Typically 8 or more years of product or application security experience; hands-on experience building security tools and services is emphasized over a specific number of years.
Experience designing security architecture that scales across many teams and services.
Strong understanding of web application security principles and hands-on experience with application testing tools such as Burp Suite, OWASP ZAP, or similar.
Software development experience building security tools in at least one modern language, such as Go, Python, Java/Kotlin, TypeScript, Ruby, or similar.
Track record of leading multi-team technical initiatives and mentoring engineers into senior roles.

Nice To Haves

Experience running or scaling a security champions program.
Identity management and identity federation experience, including SAML, OAuth, or SCIM.
Experience with IaaS cloud infrastructure, Kubernetes, containers, and service-oriented architectures.
Hands-on experience with bug bounty platforms and SAST tools such as Cycode, Semgrep, Snyk, or similar.
Experience performing code audits on internal or open-source libraries before production release.

Responsibilities

Define security architecture for Flexport products and services and establish secure-by-default patterns and reference implementations.
Lead security engineering reviews for the highest-risk product features and set standards for reviews conducted by others.
Build and scale the security champions program and product-security training.
Lead domain-specific threat modeling and attack-surface analysis across Flexport’s product surface.
Partner with engineering leadership to resolve complex design tradeoffs.
Establish standards for triaging, reproducing, and prioritizing bug bounty submissions and internal security reports; handle the hardest or highest-severity cases.
Drive remediation of systemic vulnerability classes.
Own security services and tooling used by product teams across global infrastructure.
Mentor engineers and serve as the authoritative technical voice on product security across engineering leadership.