Staff Security Engineer, Product Security at Flexport · LumiJobs
senior
$165k–$202k
H1B: yes
Flexport Staff Security Engineer at Flexport to define security architecture and lead security engineering reviews for product features. Build and scale security programs and mentor engineers.
Responsibilities
Architecture & strategy
Define security architecture for Flexport's products and services, and set the patterns and reference implementations that make secure-by-default the path of least resistance.
Lead security engineering reviews for the highest-risk product features, and set the bar for what "good" looks like in reviews you don't personally run.
Build and scale the security champions program and product security training that extend your judgment into teams where you can't be in every review.
Design-time & review
Lead domain-specific threat modeling and attack surface analysis across Flexport's product surface, not just individual features.
Partner with engineering leadership to resolve the design tradeoffs that a senior engineer would escalate.
Vulnerability management
Set the bar for how the team triages, reproduces, and prioritizes bug bounty submissions and internal security reports, and step in on the hardest or highest-severity cases.
Drive remediation of systemic classes of vulnerability, not just individual findings.
Developer enablement & leadership
Own the security services and tooling consumed by product teams across our global infrastructure.
Qualification
Required
2–5 years of experience in product/application security or software development with a security focus
Strong grasp of web application security principles and common attack vectors (e.g., OWASP Top 10)
Proficiency with application testing tools such as Burp Suite, OWASP ZAP, or browser developer tools
Working knowledge of at least one modern programming language (e.g., Ruby, Java/Kotlin, TypeScript/JavaScript, Python)
Working knowledge of at least one major cloud provider (AWS, GCP, Azure)
Comfortable with security on-call rotation and picking up work across security disciplines
Preferred
Hands-on experience with bug bounty platforms
Hands-on experience with SAST tools (Cycode, Semgrep, Snyk, or similar)
Experience with cloud infrastructure security and container technologies
Participation in CTF events or open-source security projects
Familiarity with threat modeling frameworks and secure SDLC best practices
Interest in contributing to internal developer security training programs
We're in the San Francisco office regularly to whiteboard and ship together
We stay closely aligned with teammates on other continents via Slack, video, and async docs
