Security Engineer

Remote. Posted 6 months ago

The role

You will be the first dedicated security hire at Flox. You will deploy tools, configure controls, harden infrastructure, and build security practices from scratch.

What you will do

Implement SIEM or manage an outsourced SOC provider
Build incident response runbooks and triage workflows
Scan and harden AWS posture including IAM, SCPs, and GuardDuty
Own Cloudflare configuration for WAF, DDoS, and Zero Trust
Implement IaC security scanning into CI/CD pipelines
Deploy and manage endpoint protection across developer and production systems
Secure build and release pipelines and manage dependency vulnerability scanning
Integrate SAST and SCA tooling into developer workflows
Participate in security design reviews and threat modeling
Audit and rationalize IAM across AWS, Cloudflare, and SaaS applications

Required qualifications

3–5 years of hands-on security engineering experience
Demonstrable track record of implementing security tools and controls
Solid working knowledge of AWS security services
Hands-on experience with Cloudflare
Experience deploying and managing endpoint protection (EDR/MDM)
Familiarity with software supply chain concepts
Experience integrating SAST, SCA, or DAST tools into CI/CD pipelines
Comfort with scripting or light automation (Python, Bash, or similar)
Ability to work independently, ruthlessly prioritize, and operate without a playbook

Nice to have

Familiarity with Nix, package management, or reproducible build systems
Experience evaluating or managing an outsourced SOC relationship
Prior SIEM deployment or detection engineering experience
Experience supporting a SOC 2 or ISO 27001 audit
Security certifications (CISSP, OSCP, AWS Security Specialty, etc.)

Benefits

Competitive salary
Meaningful equity in a well-funded company
Flexible hybrid environment

About the company

Flox is a company where security is core to the value delivered, managing dependencies, environments, and build artifacts for large engineering teams.