F · via a16z Speedrun 1d ago Security Engineer, Product Security Flexport US –Express

Position: F Open role · via a16z Speedrun 1d ago Staff Security Engineer, Product Security Flexport US $148k–271k Express
Location: New York

Flexport# Staff Security Engineer, Product Security $148k–271k Remote-friendly U.S. RemoteAT A GLANCE Staff-level product security engineer responsible for defining security architecture, leading threat modeling, managing vulnerabilities, and mentoring teams across Flexport's global infrastructure.

LEVEL staff
· 8+ yrsKEY SKILLS Application Security Threat Modeling Burp SuiteOWASPPython Go Type Script Kubernetes OAuthSAMLSAST Tools Security Architecture Bug Bounty Management Code Auditing WHAT YOU'LL DO
* Define security architecture and patterns for products and services
* Lead security engineering reviews for high-risk features
* Build and scale security champions program and training
* Conduct domain-specific threat modeling and attack surface analysis
* Partner with engineering leadership on design tradeoffs
* Set standards for triaging and prioritizing security reports and bug bounties
* Drive remediation of systemic vulnerability classes
* Own security services and tooling for product teamsTHE ROLE About Flexport At Flexport, we believe global trade can move the human race forward. That’s why it’s our mission to make global commerce so easy there will be more of it. We’re shaping the future of a $10T industry with solutions powered by innovative technology and exceptional people. Today, companies of all sizes—from emerging brands to Fortune 500s—use Flexport technology to move more than $19B of merchandise across 112 countries a year.

The recent global supply chain crisis has put Flexport center stage as we continue to play a pivotal role in how goods move around the world. We are proud to have the support of the best investors in the game who believe in our mission, solutions and people. Ready to tackle global challenges that impact business, society, and the environment? Come join us.

What You'll Do
* Architecture & strategy
* Define security architecture for Flexport's products and services, and set the patterns and reference implementations that make secure-by-default the path of least resistance.
* Lead security engineering reviews for the highest-risk product features, and set the bar for what "good" looks like in reviews you don't personally run.
* Build and scale the security champions program and product security training that extend your judgment into teams where you can't be in every review.
* Design-time & review
* Lead domain-specific threat modeling and attack surface analysis across Flexport's product surface, not just individual features.
* Partner with engineering leadership to resolve the design tradeoffs that a senior engineer would escalate.
* Vulnerability management
* Set the bar for how the team triages, reproduces, and prioritizes bug bounty submissions and internal security reports, and step in on the hardest or highest-severity cases.
* Drive remediation of systemic classes of vulnerability, not just individual findings.
* Developer enablement & leadership
* Own the security services and tooling consumed by product teams across our global infrastructure.
* Mentor other engineers on the team, and act as the authoritative technical voice on product security across engineering leadership.

You Should Have
* Typically 8+ years of experience in product/application security, with real hands-on time building security tools and services, not just reviewing them — we care more about what you've built than the exact number.
* A track record of designing security architecture that scales across many teams and services, not just securing a single product.
* Strong grasp of web application security principles and hands-on experience with application testing tools (Burp Suite, OWASP ZAP, or similar)
* Software development experience building security tools in at least one modern language (Go,…