Staff Security Engineer, Product Security
At its midpoint, $209k/yr, this role pays less than the $218k/yr midpoint for Application & Product Security openings today (usual band $171k–$346k/yr).
The full posting
About Flexport:
At Flexport, we believe global trade can move the human race forward. That’s why it’s our mission to make global commerce so easy there will be more of it. We’re shaping the future of a $10T industry with solutions powered by innovative technology and exceptional people. Today, companies of all sizes - from emerging brands to Fortune 500s - use Flexport technology to move more than $19B of merchandise across 112 countries a year.
The recent global supply chain crisis has put Flexport center stage as we continue to play a pivotal role in how goods move around the world. We are proud to have the support of the best investors in the game who believe in our mission, solutions and people. Ready to tackle global challenges that impact business, society, and the environment? Come join us.
What You'll Do
- Architecture & strategy Define security architecture for Flexport's products and services , and set the patterns and reference implementations that make secure-by-default the path of least resistance.
- Lead security engineering reviews for the highest-risk product features , and set the bar for what "good" looks like in reviews you don't personally run.
- Build and scale the security champions program and product security training that extend your judgment into teams where you can't be in every review.
- Design-time & review Lead domain-specific threat modeling and attack surface analysis across Flexport's product surface, not just individual features.
- Partner with engineering leadership to resolve the design tradeoffs that a senior engineer would escalate.
- Vulnerability management Set the bar for how the team triages, reproduces, and prioritizes bug bounty submissions and internal security reports, and step in on the hardest or highest-severity cases.
- Drive remediation of systemic classes of vulnerability , not just individual findings.
- Developer enablement & leadership Own the security services and tooling consumed by product teams across our global infrastructure.
- Mentor other engineers on the team, and act as the authoritative technical voice on product security across engineering leadership.
You Should Have
- Typically 8+ years of experience in product/application security, with real hands-on time building security tools and services, not just reviewing them - we care more about what you've built than the exact number.
- A track record of designing security architecture that scales across many teams and services , not just securing a single product.
- Strong grasp of web application security principles and hands-on experience with application testing tools (Burp Suite, OWASP ZAP, or similar)
- Software development experience building security tools in at least one modern language (Go, Python, Java/Kotlin, TypeScript, Ruby, or similar)
- Track record of leading multi-team technical initiatives and mentoring engineers into senior roles
Nice to Have
- Experience running or scaling a security champions program
- Identity management and identity federation experience (SAML, OAuth, SCIM)
- Experience with IaaS cloud infrastructure, Kubernetes, containers, and service-oriented architectures
- Hands-on experience with bug bounty platforms and SAST tools (Cycode, Semgrep, Snyk, or similar)
- Experience performing code audits on internal or open-source libraries before they ship in production
How We Work
- We stay closely aligned with teammates on other continents via Slack, video, and async docs
- We have the latest hardware and software, including frontier AI models on day one
- We're agile, but not dogmatic - the team decides how it works best
Why This Role Is Special
- Massive leverage: the conventions and champions program you build are multiplied across hundreds of engineers who never talk to you directly.
- Broad authority: you set the architecture other reviews are measured against, rather than being the one measured.
- You're part of PSI: the platform, security, and infrastructure teams work hand in hand, and security is treated as infrastructure with real engineering quality bars, not a policy function.
#LI-Remote
#LI-VA1
The range displayed on each job posting reflects the minimum and maximum target for new hire salaries for the position across all US locations. Our salary ranges are determined by role, level, and location. Within the range displayed, individual pay is determined by work location and additional factors, including job-related skills, experience, and relevant education and / or training. Base salary is just one part of our total rewards package at Flexport, which also includes bonus, equity, and comprehensive benefit offerings such as medical, dental, and flexible time off.
California Pay Range
$148,210 - $270,703 USD
Washington Pay Range
$196,875 - $270,703 USD
Colorado Pay Range
$148,210 - $185,263 USD
New York City Pay Range
$196,875 - $270,703 USD
Illinois Pay Range
$148,210 - $185,263 USD
Commitment to Equal Opportunity
At Flexport, our ability to fulfill our mission of making global commerce easy and accessible relies on having a diverse, dedicated and engaged workforce. All qualified applicants will receive consideration for employment regardless of race, color, religion, sex, national origin, age, physical and mental disability, health status, marital and family status, sexual orientation, gender identity and expression, military and veteran status, and any other characteristic protected by applicable law.
Global Data Privacy Notice for Job Candidates and Applicants
Depending on your location, the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA) may regulate the way we manage the data of job applicants. By submitting your application, you are agreeing to our use and processing of your data as required. Please see our Privacy Notice available at www.flexport.com/privacy for additional information.
Where you can work
This role is 100% remote, for applicants located in United States.
Text as Flexport published it; last compared with the original on 11 Nov 2026.
The application
Your details, CV and LinkedIn, then 8 questions (1 written).
- 1.Current or Most Recent TitleShort answer
- 2.Current or Most Recent CompanyShort answer
- 3.How did you first hear about Flexport?Pick one (9 options)
- 4.Let us know which specific channel/event/medium/etc you heard about us:Short answer · optional
- 5.Will you now or in the future require Flexport to commence ("sponsor") an immigration case in order to employ you (for example, H-1B or other employment-based immigration case)? This is sometimes called "sponsorship" for an employment-basedYes or no
- 6.Are you authorized to work lawfully in the United States for Flexport?Yes or no
- 7.Have you previously been employed by Flexport or any of its entities; or by an agency representing Flexport?Yes or no
- 8.Describe a complex product feature or service you threat modeled from scratch. What major architectural risks did you identify, and how did you partner with engineering to resolve the design tradeoffs?Written answer
Taken from Flexport's application form as it stood on 11 Nov 2026.
The employer: Flexport
Flexport moves freight for importers and exporters on its own software platform; security engineers there cover product security, corporate security and detection.
Pay and benefits: Full-time roles in San Francisco, remote US or Amsterdam at a privately held logistics company.
Let security teams come to you
Security teams sometimes ask us directly for someone with a given specialty, clearance or certification. Join the candidate pool once and we put you forward when a brief matches, and only after you say yes. No cost to you.
Hear first when Flexport posts a security role
We read Flexport's careers system around the clock and send its new security roles in a weekly email, along with comparable openings at other employers. Free; leave whenever you like.