Flexport Security Engineer at Flexport responsible for advancing identity posture and automating corporate security processes. Focus on writing code and shipping automation to protect laptops, identity providers, SaaS, and cloud estates.
Responsibilities
Identity & access
Advance our identity posture: SSO coverage, phishing-resistant MFA rollout, SCIM lifecycle automation, and least-privilege access across the SaaS and cloud estate.
Build the detections and guardrails that catch account takeover, MFA fatigue attacks, and session token theft before they turn into incidents.
Endpoint & device lifecycle
Write and ship device policy as code — configuration profiles, remediation scripts, and enforcement rules across macOS and Windows — with staged rollout and rollback built in from day one.
Maintain and improve our EDR stack's detection and response coverage across the fleet.
Reduce SaaS risk at scale through SSPM tooling and automation, including detection of risky OAuth grants, shadow IT, and configuration drift across our critical SaaS applications.
Own security configuration for the SaaS tools hundreds of Flexporters use daily (Google Workspace, Slack, and similar), and keep pace as we add AI agents and MCP integrations to that surface.
Automation & enablement
Automate the parts of corporate security that don't need a human — device provisioning, access reviews, vendor security questionnaires — so the team scales with headcount instead of straining against it.
Write runbooks and documentation that make the rest of the team more capable, and partner with IT and People teams to ship controls that don't create the friction that drives people to workarounds.
Typically 2–5 years of experience in corporate, enterprise, or IT security engineering — we care more about what you've shipped than the exact number. If you meet most of this, apply; we'd rather see your work than filter you out on a résumé line.
Qualification
2–5 years experience in corporateExposure to DLP or insider-risk tooling
Required
2–5 years experience in corporate, enterprise, or IT security engineering
Hands-on experience with modern endpoint management and EDR tooling
Working knowledge of identity protocols and major identity providers
Comfort writing code or scripts in Python, Go, or similar
Preferred
Experience with SSPM tooling and OAuth-grant governance.
Exposure to DLP or insider-risk tooling.
Familiarity with infrastructure-as-code (Terraform) for managing security configuration.
A point of view on how agentic AI tools and MCP integrations change what corporate security needs to watch for
Interest in growing into a broader corporate security or detection engineering scope over time.
We're in the San Francisco office regularly to work through incidents and detection design in person.
We stay closely aligned with teammates on other continents via Slack, video, and async docs.
We have the latest hardware and software, including frontier AI models on day one.
