<div class="content-intro"><h2><strong>About Flexport: </strong></h2> <p>At Flexport, we believe global trade can move the human race forward. That’s why it’s our mission to make global commerce so easy there will be more of it. We’re shaping the future of a $10T industry with solutions powered by innovative technology and exceptional people. Today, companies of all sizes—from emerging brands to Fortune 500s—use Flexport technology to move more than $19B of merchandise across 112 countries a year. </p> <p>The recent global supply chain crisis has put Flexport center stage as we continue to play a pivotal role in how goods move around the world. We are proud to have the support of the best investors in the game who believe in our mission, solutions and people. Ready to tackle global challenges that impact business, society, and the environment? Come join us.</p></div><h2><strong>About Flexport: </strong></h2> <p>At Flexport, we believe global trade can move the human race forward. That’s why it’s our mission to make global commerce so easy there will be more of it. We’re shaping the future of a $10T industry with solutions powered by innovative technology and exceptional people. Today, companies of all sizes - from emerging brands to Fortune 500s - use Flexport technology to move more than $19B of merchandise across 112 countries a year. </p> <p>The recent global supply chain crisis has put Flexport center stage as we continue to play a pivotal role in how goods move around the world. We are proud to have the support of the best investors in the game who believe in our mission, solutions and people. Ready to tackle global challenges that impact business, society, and the environment? Come join us.</p> <h1>Product Security Engineer II</h1> <p>Flexport is looking for Product Security Engineers to help Flexport establish itself as the most trusted company in the global trade ecosystem. As a Product Security Engineer, you’ll develop a deep understanding of product development and strategy, and will be able to quickly identify and communicate security risks to diverse audiences while offering alternative solutions.</p> <p>All security disciplines work under the umbrella of the combined PSI (Platform, Security & Infrastructure) team: we build the paved path and tooling that hundreds of engineers around the world rely on every day to ship. Security gains massive leverage by working hand in hand with Platform and Infrastructure, with every element of the team reinforcing each of the others.</p> <p>This is not a role where you wait for tickets. You’ll build the tools that our product teams reach for when they want a secure-by-default solution. You’ll discover what tools to build by working with our product teams at every stage of the software development lifecycle. And you’ll proactively analyze what they produce to find the flaws before the bad guys do.</p> <h2><strong>What You'll Do</strong></h2> <p><em>Strategy & foundations</em></p> <ul> <li>Build guardrails and AI-accelerated patterns that make secure-by-default the path of least resistance for developers.</li> <li>Build and maintain security tooling and automation that scales product security.</li> <li>Respond to emerging threats.</li> </ul> <p><em>Design-time & review</em></p> <ul> <li>Contribute to threat modeling, design reviews, and code reviews with pragmatic guidance that balances risk against velocity.</li> <li>Partner with engineering to security-review and test new features and services as they're built.</li> </ul> <p><em>Vulnerability management</em></p> <ul> <li>Triage, reproduce, and validate incoming bug bounty submissions and internal security reports.</li> <li>Cut through SAST, secrets, and vulnerability scanner noise to prioritize real issues and guide developers to effective fixes.</li> <li>Partner with development teams to drive remediation and track issues through closure.</li> </ul> <p><em>Developer enablement</em></p> <ul> <li>Write clear, actionable security patterns that let developers ship fast and stay secure.</li> <li>Write and maintain runbooks, developer guidelines, and security documentation that scale the team's practices.</li> <li>Stay current on web and cloud security trends and bring new findings into product discussions.</li> </ul> <h2><strong>You Should Have</strong></h2> <ul> <li>2–5 years of experience in product/application security or software development with a security focus.</li> <li>Strong grasp of web application security principles and common attack vectors (e.g., OWASP Top 10).</li> <li>Proficiency with application testing tools such as Burp Suite, OWASP ZAP, or browser developer tools.</li> <li>Working knowledge of at least one modern programming language (e.g., Ruby, Java/Kotlin, TypeScript/JavaScript, Python).</li> <li>Working knowledge of at least one major cloud provider (AWS, GCP, Azure).</li> <li>Hands-on experience with SAST tools (Cycode, Semgrep, Snyk, or similar).</li> <li>Experience improving developer experience (DevEx) security without slowing teams down.</li> <li>Clear, constructive communicator on technical risk - in writing, in code review, and in conversation.</li> <li>Collaborative by default: you partner with developers, SREs, and security peers rather than handing down mandates.</li> <li>Comfortable with security on-call rotation and picking up work across security disciplines when needed.</li> </ul> <h2><strong>Nice to Have</strong></h2> <ul> <li>Hands-on experience with bug bounty platforms.</li> <li>Experience with cloud infrastructure security (AWS, GCP, Azure) and container technologies.</li> <li>Participation in CTF events or open-source security projects.</li> <li>Familiarity with threat modeling frameworks and secure SDLC best practices.</li> <li>Interest in contributing to internal developer security training programs.</li> </ul> <h2><strong>How We Work</strong></h2> <ul> <li>In Amsterdam we come to the office 3 times a week to h