Security Engineer, Product Security

What You'll Do

• Architecture & strategy
  • Define security architecture for Flexport's products and services, and set the patterns and reference implementations that make secure-by-default the path of least resistance.
  • Lead security engineering reviews for the highest-risk product features, and set the bar for what "good" looks like in reviews you don't personally run.
  • Build and scale the security champions program and product security training that extend your judgment into teams where you can't be in every review.
• Design-time & review
  • Lead domain-specific threat modeling and attack surface analysis across Flexport's product surface, not just individual features.
  • Partner with engineering leadership to resolve the design tradeoffs that a senior engineer would escalate.
• Vulnerability management
  • Set the bar for how the team triages, reproduces, and prioritizes bug bounty submissions and internal security reports, and step in on the hardest or highest-severity cases.
  • Drive remediation of systemic classes of vulnerability, not just individual findings.
• Developer enablement & leadership
  • Own the security services and tooling consumed by product teams across our global infrastructure.
  • Mentor other engineers on the team, and act as the authoritative technical voice on product security across engineering leadership.

You Should Have

• Typically 2–5 years of experience in product/application security or software development with a security focus — we care more about what you've built than the exact number. If you meet most of this, apply; we'd rather see your work than filter you out on a résumé line.
• Strong grasp of web application security principles and common attack vectors (e.g., OWASP Top 10)
• Proficiency with application testing tools such as Burp Suite, OWASP ZAP, or browser developer tools
• Working knowledge of at least one modern programming language (e.g., Ruby, Java/Kotlin, TypeScript/JavaScript, Python) and at least one major cloud provider (AWS, GCP, Azure)
• Comfortable with security on-call rotation and picking up work across security disciplines when needed

Nice to Have

• Hands-on experience with bug bounty platforms
• Hands-on experience with SAST tools (Cycode, Semgrep, Snyk, or similar)
• Experience with cloud infrastructure security and container technologies
• Participation in CTF events or open-source security projects
• Familiarity with threat modeling frameworks and secure SDLC best practices
• Interest in contributing to internal developer security training programs

How We Work

• We're in the San Francisco office regularly to whiteboard and ship together
• We stay closely aligned with teammates on other continents via Slack, video, and async docs
• We have the latest hardware and software, including frontier AI models on day one
• We're agile, but not dogmatic — the team decides how it works best

Why This Role Is Special

• Massive leverage: the conventions and champions program you build are multiplied across hundreds of engineers who never talk to you directly.
• Broad authority: you set the architecture other reviews are measured against, rather than being the one measured.
• You're part of PSI: the platform, security, and infrastructure teams work hand in hand, and security is treated as infrastructure with real engineering quality bars, not a policy function.

Where you'll work

This role is based in San Francisco, and we have a strong preference for candidates who are there or willing to relocate — we're deliberately building this team in one place. Relocation support is available for the right candidate.

Investing your time with Flexport means having immediate impact, all over the world. You're empowered to do what's best for everyone and trusted to make the right decisions when and where you need them. Join our collective of entrepreneurs and improve the world's experience in global trade.

#LI-Onsite

#LI-VA1