Staff Security Engineer

Flock is a company dedicated to enhancing public safety through technology, and they are seeking a Staff Security Engineer to lead their Product Security Incident Response Team. The role focuses on managing vulnerabilities across hardware, firmware, and cloud systems, ensuring timely remediation and clear communication of security advisories.

Responsibilities:

• Own the operational model and execution of Flock's Product Security Incident Response Team (PSIRT) across every externally reported and internally discovered product vulnerability
• Serve as the operational lead for our CVE Numbering Authority (CNA), managing vulnerability intake, triage SLAs, severity rubrics, and public CVE record publishing
• Drive cross-functional remediation efforts across Hardware, Firmware, Device SRE, Cloud SRE, Mobile, Legal, Communications, and Support to ensure timely patch delivery
• Author clear, accurate public security advisories, internal postmortems, and executive summaries tailored to technical, legal, and leadership audiences
• Establish metrics and operational reporting for PSIRT performance, tracking time-to-triage, time-to-fix, and time-to-disclose

Requirements:

• Demonstrated experience leading or running a PSIRT, product security, or coordinated vulnerability disclosure function, ideally within connected hardware or IoT environments
• Deep operational experience acting as a CVE Numbering Authority (CNA) or implementing the FIRST PSIRT Services Framework across discovery, triage, remediation, and disclosure
• Hands-on technical background in product security across embedded or firmware security, Linux or Android device security, AWS cloud security, or mobile application security
• Expertise applying CVSS, CWE, EPSS, and SSVC frameworks to evaluate risk and assign accurate vulnerability severities
• Strong written communication skills with the capability to translate complex technical vulnerabilities into clear advisories for customers, engineers, and executives