Senior Security Engineer, Detection & Response

At Flexport we believe global trade can move the human race forward. Thats why its our mission to make global commerce so easy there will be more of it. Were shaping the future of a $10T industry with solutions powered by innovative technology and exceptional people. Today companies of all sizesfrom emerging brands to Fortune 500suse Flexport technology to move more than $19B of merchandise across 112 countries a year.

The recent global supply chain crisis has put Flexport center stage as we continue to play a pivotal role in how goods move around the world. We are proud to have the support of the best investors in the game who believe in our mission solutions and people. Ready to tackle global challenges that impact business society and the environment Come join us.

There is no MSSP and no tier-1 queue here. Detection & Response engineers own their detections end to end: you write them you tune them and your team is paged when they fire. The security team is spread across the globe with a follow-the-sun pager rotation so nobody is paged at 3am local.

The adversaries are real. The business is growing fast and the threat surface is growing with it. Defining the necessary telemetry is part of the job.

Detection engineering

• Build and tune detections across endpoint identity SaaS and cloud treating them as software: version-controlled peer-reviewed and shipped through the same CI/CD practices the rest of engineering uses.
• Track detection quality as measured quantities: coverage against MITRE ATT&CK precision time-to-detect. We dont build-and-forget here.

Response & automation

• Own incident response: triage contain remediate and write the retrospective that turns the incident into a systemic fix.
• Build automation that removes toil from investigations and partner closely with the US-based team so context carries across time zones instead of getting lost at handoff.

Telemetry & partnership

• Define telemetry requirements for new systems before they ship working with infrastructure and product teams to close visibility gaps rather than discovering them during an incident.
• Threat hunt proactively across the estate converting hypotheses into either new detections or documented coverage.

• Typically 58 years of experience in detection engineering incident response or threat hunting with real hands-on time writing and tuning detections. We care more about what youve built than the exact number.
• Proficiency in at least one programming language (Python Go or similar) and comfort writing production-grade detection and automation code.
• Experience with a modern SIEM or detection pipeline (Panther Elastic Splunk or similar). What matters is that youve shipped and tuned detection logic in production.
• Practical incident response experience: youve led or played a major role in triaging and closing out real security incidents.

• Experience treating detections as code with CI/CD peer review and staged rollout.
• Experience defining telemetry contracts for systems before they ship rather than retrofitting logging after an incident.
• A track record of critically evaluating and verifying AI-assisted work - testing source-checking validation - rather than trusting agent output by default. If you havent already spotted the em dashes in this job description and already thought about where the hiring manager (hi!) has put hands on keyboard and compared that to where they let the LLM watermarks through you might not be the right person for the job.
• Familiarity with cloud-native and Kubernetes telemetry.
• Experience with fraud or financial-crime detection patterns.

• Were in the San Francisco office regularly to work through incidents and detection design in person.
• We stay closely aligned with teammates on other continents via Slack video and async docs.
• We have the latest hardware and software including frontier AI models on day one.
• Were agile but not dogmatic. Teams decide how they work best.

• You own your detections end to end no MSSP no tier-1 queue no handing your work to someone else to triage.
• The consequences here are physical not abstract: a containment decision can stop a customs filing or freight actually moving which makes the stakes concrete in a way a SaaS control plane rarely is.
• Youll inherit a real established estate with legacy telemetry gaps to close genuinely underexplored surface area not a well-mined problem.

This role is based in San Francisco and we have a strong preference for candidates who are there or willing to relocate were deliberately building this team in one place. Relocation support is available for the right candidate.

Investing your time with Flexport means having immediate impact all over the world. Youre empowered to do whats best for everyone and trusted to make the right decisions when and where you need them. Join our collective of entrepreneurs and improve the worlds experience in global trade.

#LI-Onsite