Senior Software Engineer, Security

The role

You will build the security of Flex's money-moving systems, including the ledger, card issuing, payouts and stablecoin work. You will threat model new designs and continuously assess existing code, building automated checks and secure defaults. You report directly to the CTO.

What you will do

• Threat model the paths that move money: the ledger and write path, card issuing, payouts, and the stablecoin work.
• Build secure-by-default infrastructure: Infrastructure as Code guardrails, CI/CD supply chain integrity, secrets handling, service isolation, and workload IAM.
• Build a just-in-time, least-privilege access system for cloud access.
• Own application security across new and existing systems, including automated checks and secure defaults in the development lifecycle.
• Build a golden path that keeps sensitive data out of logs, and tooling that proves it.
• Run the vulnerability disclosure program end to end, and grow it into a bug bounty when triage volume allows.
• Scope and manage external penetration tests, and drive remediation afterwards.
• Build security automation, including AI-assisted triage and review.
• Partner with Engineering, IT and Corporate Engineering, Risk, and Compliance on security reviews and audits.

Required qualifications

• Strong software engineer first, able to pass a normal engineering interview loop.
• Ability to build as a builder and think as an attacker.
• Experience shipping a security tool or control that engineers actually adopted.
• Ability to explain unsafe code to a senior colleague in plain language and build a better alternative with them.
• Comfort owning problems end to end with limited guidance.
• Ability to make risk-based calls and decide when something is not worth fixing now.
• Ability to find trust boundaries in a system diagram.
• Clear written communication.
• Substantial hands-on experience building or securing systems in a fast-moving environment, including a stretch as the most senior person doing this work.
• Real software engineering ability in a language such as Python, Go, or TypeScript.
• Hands-on cloud infrastructure experience with AWS or GCP, Terraform or equivalent IaC, containers, and CI/CD pipelines.
• Practical threat modeling on systems with real consequences.

Nice to have

• A platform, infrastructure, or DevOps background where you moved toward security by choice.
• Experience at a small company or as a founder, as the only person who could do this work.
• Experience running a VDP or bug bounty program, including triage.
• Fintech, payments, or regulated environment experience on the building side.
• Experience applying AI or LLM tooling to security work in production.
• Certifications such as OSCP or OSWE.

Benefits

• Meaningful equity.
• Small teams, high trust, and real accountability.
• Direct access to leadership, customers, and investors.

About the company

Flex builds AI-native financial services for business owners, covering banking, credit, payments, personal finance, and financial operations. The company launched publicly in September 2023 and has raised $100M+ in equity and $300M+ in debt.