> Markdown version of [/jobs/ext/4671637-staff-security-engineer-product-security](https://www.wearedevelopers.com/jobs/ext/4671637-staff-security-engineer-product-security). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Staff Security Engineer, Product Security - **Company:** Flexport Inc. - **Location:** San Francisco, CA, United States - **Experience:** Expert - **Salary:** $221,484 - $270,703 - **Contract:** Permanent contract - **Skills:** Java (Programming Language), Application Testing, Burp Suite, Cloud Computing, Cyber Security, Infrastructure as a Service (IaaS), Identity and Access Management, Python (Programming Language), Machine Learning, OAuth, Ruby, Security Assertion Markup Language (SAML), Web Application Security, Service-Oriented Architecture, Software Engineering, TypeScript, Software Vulnerability Management, Software Security, Kotlin, Kubernetes, Static Application Security Testing, Golang - **Published:** November 11, 2026 - **Apply:** https://job-boards.greenhouse.io/flexport/jobs/8374701 ## About the Role * Typically 8+ years of experience in product/application security, with real hands-on time building security tools and services, not just reviewing them - we care more about what you've built than the exact number. * A track record of designing security architecture that scales across many teams and services, not just securing a single product. * Strong grasp of web application security principles and hands-on experience with application testing tools (Burp Suite, OWASP ZAP, or similar) * Software development experience building security tools in at least one modern language (Go, Python, Java/Kotlin, TypeScript, Ruby, or similar) * Track record of leading multi-team technical initiatives and mentoring engineers into senior roles Nice to Have * Experience running or scaling a security champions program * Identity management and identity federation experience (SAML, OAuth, SCIM) * Experience with IaaS cloud infrastructure, Kubernetes, containers, and service-oriented architectures * Hands-on experience with bug bounty platforms and SAST tools (Cycode, Semgrep, Snyk, or similar) * Experience performing code audits on internal or open-source libraries before they ship in production ## Description + Define security architecture for Flexport's products and services, and set the patterns and reference implementations that make secure-by-default the path of least resistance. + Lead security engineering reviews for the highest-risk product features, and set the bar for what "good" looks like in reviews you don't personally run. + Build and scale the security champions program and product security training that extend your judgment into teams where you can't be in every review. * Design-time & review + Lead domain-specific threat modeling and attack surface analysis across Flexport's product surface, not just individual features. + Partner with engineering leadership to resolve the design tradeoffs that a senior engineer would escalate. * Vulnerability management + Set the bar for how the team triages, reproduces, and prioritizes bug bounty submissions and internal security reports, and step in on the hardest or highest-severity cases. + Drive remediation of systemic classes of vulnerability, not just individual findings. * Developer enablement & leadership + Own the security services and tooling consumed by product teams across our global infrastructure. + Mentor other engineers on the team, and act as the authoritative technical voice on product security across engineering leadership., * We're in the San Francisco office regularly to whiteboard and ship together * We stay closely aligned with teammates on other continents via Slack, video, and async docs * We have the latest hardware and software, including frontier AI models on day one * We're agile, but not dogmatic - the team decides how it works best Why This Role Is Special * Massive leverage: the conventions and champions program you build are multiplied across hundreds of engineers who never talk to you directly. * Broad authority: you set the architecture other reviews are measured against, rather than being the one measured. * You're part of PSI: the platform, security, and infrastructure teams work hand in hand, and security is treated as infrastructure with real engineering quality bars, not a policy function.