Software Supply Chain

• Secure our build and release pipelines
• Consider SLSA framework adoption and supply chain integrity attestations for our catalog and environments
• Stand up dependency vulnerability scanning and own the remediation workflow end-to-end for third-party services, libraries, middleware, operating systems, and SaaS

Application Security

• Integrate SAST and SCA tooling (Semgrep, Snyk, GitHub Advanced Security) into developer workflows
• Participate in security design reviews and threat modeling for new features
• Work shoulder-to-shoulder with developers to find and fix vulnerabilities using a risk-based model instead of just vulnerability aging reports

Identity, Access & Entitlements

This is a priority area—but implemented right for a company at our size, not over-engineered for a company ten times larger.

• Audit and rationalize IAM across AWS, Cloudflare, SaaS applications, and internal tooling; implement the fixes, not just the findings
• Drive SSO consolidation, enforce MFA universally, and implement least-privilege access in practice, not just policy
• Build a lightweight, repeatable access review process—something that actually runs on a cadence and produces real decisions
• Own joiner/mover/leaver processes so that entitlements stay clean as the team grows
• Evaluate and implement an appropriate identity governance solution for our stage—not an enterprise IGA platform, but something that gives us control and auditability

WHAT WE’RE LOOKING FOR

• 3–5 years of hands-on security engineering experience, ideally at a software company or cloud-native environment
• A demonstrable track record of implementing security tools and controls, not just scoping or recommending them
• Solid working knowledge of AWS security services: IAM, SCPs, GuardDuty, Security Hub, CloudTrail, and related tooling
• Hands-on experience with Cloudflare—WAF rule management, Zero Trust, DLP, or similar; comfort learning what you haven’t used yet
• Experience deploying and managing endpoint protection (EDR/MDM) across a mixed developer and production environment
• Familiarity with software supply chain concepts: SBOMs, dependency management, artifact signing, SLSA
• Experience integrating SAST, SCA, or DAST tools into CI/CD pipelines
• Comfort with scripting or light automation (Python, Bash, or similar) to build repeatable processes
• Ability to work independently, ruthlessly prioritize, and operate without a playbook
• The kind of person who is bothered when something is insecure and doesn’t wait for someone else to fix it

NICE TO HAVE

• Familiarity with Nix, package management, or reproducible build systems
• Experience evaluating or managing an outsourced SOC relationship
• Prior SIEM deployment or detection engineering experience
• Experience supporting a SOC 2 or ISO 27001 audit
• Security certifications (CISSP, OSCP, AWS Security Specialty, etc.)

WHY FLOX

• First dedicated security hire—you’ll build the program, not inherit someone else’s backlog
• A product developers genuinely love, which makes working with the engineering team easier
• Small team, short feedback loops, real ownership—your work will be visible immediately
• Competitive salary, meaningful equity in a well-funded company, and a flexible hybrid environment

Compensation: $160K - $210K