> Markdown version of [/jobs/ext/1348149-staff-software-engineer-security](https://www.wearedevelopers.com/jobs/ext/1348149-staff-software-engineer-security). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Staff Software Engineer - Security - **Company:** Flow LLC - **Location:** San Francisco, CA, United States - **Experience:** Expert - **Salary:** $240,000.0 - $300,000.0 - **Contract:** Permanent contract - **Skills:** Artificial Intelligence, Amazon Web Services, Microsoft Azure, Cloud Computing, Cloud Computing Security, Cyber Security, Continuous Integration, Information Systems Security Architecture Professional, Python (Programming Language), Network Security, PostgreSQL, Node.Js, TypeScript, Software Vulnerability Management, Large Language Models, Software Security, Backend - **Published:** July 19, 2026 - **Apply:** https://www.indeed.com/viewjob?jk=f67a2941804c9809 ## About the Role * 8+ years building production software, including running secure services at scale in the cloud. * Deep experience in application and cloud security (AWS, GCP, or Azure): identity and access, secrets, network security, data protection. * You've owned security in a regulated or high-trust environment and have implemented SOC 2 yourself. Export control, ITAR, or FedRAMP experience is a big plus. * Solid on threat modeling, secure architecture, and incident response. * You've secured AI or LLM systems. * You're comfortable being the security lead at a startup and setting the agenda yourself. Our stack (AI-leaning) * TypeScript/Node.js and Python for AI and backend services. * Modern LLM APIs and orchestration libraries for building agentic workflows. * Postgres and other managed cloud services for data and state. ## Description Flow Engineering is an AI-native requirements platform for modern engineering organizations, enabling hardware teams to collaborate with AI agents to design, validate, and evolve complex systems with speed and rigor., Our customers in defense, aerospace and more trust us with sensitive systems requirements. That means security is a first-order part of the product, so we're looking for a Staff Software Engineer to own it. This is our first dedicated security hire, so you'll define the security architecture, harden the platform, and build out the compliance posture. Since LLMs and agentic workflows sit at the center of what we do, you'll also lead how we secure them. What you'll do * Own security architecture across the platform: threat modeling, secure design reviews, and the standards we build against. * Harden the full stack, from application security to cloud infrastructure (identity, network, secrets), tenant isolation, and data protection. * Drive SOC 2 and get us ready for the certifications defense and aerospace customers ask about, including export control and ITAR. * Secure our AI and agentic systems: prompt injection, data leaking through models, what actions agents are allowed to take, and guardrails. * Build the security tooling we need across detection, monitoring, vulnerability management, and CI/CD. * Stand up incident response and run it, from detection through postmortems. * Work with sales and product to get through security reviews and win customer confidence. ## Related Videos - [Developing the Backend with Stefan Lingler, CTO at Shpock](https://www.wearedevelopers.com/videos/100360-developing-the-backend-with-stefan-lingler-cto-at-shpock) - [Stop using Node.js like in 2020! What changed and what you can do today with Node.js](https://www.wearedevelopers.com/videos/100011-stop-using-node-js-like-in-2020-what-changed-and-what-you-can-do-today-with-node-js) - [Do TypeScript without TypeScript](https://www.wearedevelopers.com/videos/327-do-typescript-without-typescript) - [Automated Security for the Entire SDLC](https://www.wearedevelopers.com/videos/100323-automated-security-for-the-entire-sdlc) - [Nest.js - TypeScript in the backend can also be clean](https://www.wearedevelopers.com/videos/1033-nest-js-typescript-in-the-backend-can-also-be-clean) - [Meet Your New BFF: Backend to Frontend without the Duct Tape](https://www.wearedevelopers.com/videos/682-meet-your-new-bff-backend-to-frontend-without-the-duct-tape) ## Related Articles - [Dev Digest 120 - Apple and peers](https://www.wearedevelopers.com/magazine/455-dev-digest-120-apple-and-peers) - [Highest Paying Tech Companies for Developers](https://www.wearedevelopers.com/magazine/220-highest-paying-tech-companies-for-developers) - [Dev Digest 121 - AI goes offline](https://www.wearedevelopers.com/magazine/456-dev-digest-121-ai-goes-offline) - [Dev Digest 134 - Where pixels sing?](https://www.wearedevelopers.com/magazine/477-dev-digest-134-where-pixels-sing) - [Dev Digest 137 - AI'm not sure about this](https://www.wearedevelopers.com/magazine/485-dev-digest-137-ai-m-not-sure-about-this) - [Navigating the AI Shift](https://www.wearedevelopers.com/magazine/629-navigating-the-ai-shift)