Security Engineer
Flox · Remote
About this role
## Security Engineer (First Dedicated Security Hire) **Flox is looking for its first dedicated Security Engineer** to build security practices from the ground up—pragmatic, developer-friendly, and right-sized for a company at our stage. You’ll be hands-on: deploying tools, configuring controls, hardening infrastructure, and closing gaps (not just advising). --- ## What you’ll do ### Detection, Monitoring & Response - Help evaluate whether to stand up an internal SIEM or work with an outsourced SOC provider—then implement the best path for where we are - If building internally: deploy/configure the SIEM, write and tune detection rules, and own the alerting stack - If outsourcing: manage the SOC relationship, define escalation expectations, and ensure we’re getting signal (not noise) - Build incident response runbooks and triage workflows, and **test them** (e.g., backup testing for ransomware recovery) - Be the person who sees something and does something about it ### Cloud & Infrastructure Security (AWS + Cloudflare) - Scan and harden our AWS posture hands-on (IAM policies, SCPs, security group hygiene, GuardDuty, Security Hub, and automated compliance guardrails) - Own Cloudflare configuration across WAF rules, DDoS protection, bot management, Zero Trust access, and DLP policies—keeping rules current and tuned as the product evolves - Implement IaC security scanning (Checkov, tfsec, or similar) directly into CI/CD pipelines - Own CSPM tooling: configure it, triage findings, and fix issues (not just generate reports) ### Endpoint Protection - Deploy and manage endpoint protection across developer systems and production endpoints (EDR, device posture, behavior monitoring including dynamic scans, DLP, and threat detection) - Ensure Mac-heavy developer environments meet baseline security standards while minimizing friction - Define and enforce endpoint compliance policies (disk encryption, patch posture, application controls) - Work with engineering to extend endpoint visibility into production infrastructure where applicable ### Software Supply Chain - Secure build and release pipelines - Consider SLSA adoption and supply chain integrity attestations for our catalog and environments - Stand up dependency vulnerability scanning and own remediation end-to-end for third-party services, libraries, middleware, OS packages, and SaaS ### Application Security - Integrate SAST and SCA tooling (Semgrep, Snyk, GitHub Advanced Security) into developer workflows - Participate in security design reviews and threat modeling for new features - Work with developers to find and fix vulnerabilities using a risk-based model ### Identity, Access & Entitlements - Audit and rationalize IAM across AWS, Cloudflare, SaaS applications, and internal tooling—then implement fixes - Drive SSO consolidation, enforce MFA universally, and implement least-privilege access in practice - Build a lightweight, repeatable access review process that runs on cadence and produces real decisions - Own joiner/mover/leaver processes to keep entitlements clean as the team grows - Evaluate and implement an appropriate identity governance solution for our stage (control + auditability, without over-engineering) --- ## What we’re looking for - **3–5 years** of hands-on security engineering experience (ideally at a software company or cloud-native environment) - Demonstrable track record implementing security tools/controls (not just scoping or recommending) - Solid working kno
Listing freshness
CronJobs last confirmed this listing 1h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.