Senior Software Engineer, Security

Flex is building an AI-native private bank for business owners, combining banking, credit, payments, personal finance, and financial operations into a single intelligent system. The Senior Software Engineer, Security will establish Flex’s security standard, secure product and infrastructure systems that move money, build automated security controls, and partner with engineering and other functions to manage risk.

Responsibilities:

• Threat model the paths that move money: the ledger and write path, card issuing, payouts, and the stablecoin work. Do it inside design review on anything that touches money, continuously, not as a quarterly exercise
• Build secure-by-default infrastructure. Infrastructure as Code (IaC) guardrails, CI/CD supply chain integrity, secrets handling, service isolation, and workload IAM
• Build a just-in-time, least-privilege access system for cloud access that makes engineers faster while narrowing what any one credential can do
• Own application security across both new and existing systems. Continuously assess the highest-risk parts of what we've already shipped, and build automated checks and secure defaults into the development lifecycle so the same problems stop arriving. Code review on high-risk paths, dependency and SBOM hygiene, and static and dynamic analysis where it earns its keep. Eliminate whole vulnerability classes; leave the instance-by-instance work to the machines
• Build a golden path that keeps sensitive data out of logs, and the tooling that proves it stayed out
• Run our vulnerability disclosure program end to end, and grow it into a bug bounty when we can triage at that volume. You'd take this over from an engineering leader who's carrying it today
• Scope and manage external penetration tests, and drive the remediation afterwards. We buy offensive testing; you decide what to point it at
• Build security automation, including AI-assisted triage and review, so that two people can cover a surface that usually takes a larger team
• Partner with Engineering, IT and Corporate Engineering, Risk, and Compliance. You'll be technical input on partner security reviews and audits without owning the paperwork

Requirements:

• You're a strong software engineer first. You'd be comfortable in our normal engineering interview loop
• You think like a builder and an attacker at the same time, and you'd rather remove a class of vulnerability than file fifty tickets about it
• You care about developer experience. You've shipped a security tool or control that engineers actually adopted, and you can explain why they adopted it
• You can tell a senior colleague that what they built isn't safe, explain why in plain language, and work alongside them to build a better alternative
• You're comfortable owning problems end to end with limited guidance, and comfortable saying what you need rather than quietly absorbing it
• You make risk-based calls. You have strong opinions about secure defaults, you can tell a real risk from a theoretical one, and you're comfortable deciding something isn't worth fixing right now
• You know you won't personally touch every security problem here, and you don't want to. You build the defaults and the habits that let engineers make good security decisions without you in the room
• You can read a system diagram and find the trust boundary nobody drew
• You write clearly. Much of this job is convincing people in writing, across time zones
• Substantial hands-on experience building or securing systems in a fast-moving environment, including a stretch where you were the most senior person doing this work. We care about what you've built, not the year count
• Real software engineering ability in a language we'd ship (Python, Go, TypeScript, or similar). Not scripting alone
• Hands-on cloud infrastructure experience: AWS or GCP, Terraform or equivalent IaC, containers, and CI/CD pipelines you've changed, not only used
• Practical threat modeling on systems with real consequences, and the judgment to know which findings matter
• Experience with secrets management, workload identity, and service-to-service authorization
• Experience handling inbound vulnerability reports, including at least one difficult reporter
• Clear written communication and a bias toward writing things down
• A platform, infrastructure, or DevOps background where you moved toward security by choice. A great infrastructure engineer who wants to do this work will beat a traditional security hire who wants to write policy, every time
• Experience at a small company, or as a founder, where you were the only person who could do this and had to decide what to skip
• Experience running a VDP or bug bounty program, including the triage
• Fintech, payments, or another regulated environment, on the building side
• Experience applying AI or LLM tooling to security work in a way that held up in production
• Certifications like OSCP or OSWE are a signal we'll happily read, but they don't substitute for an engineering track record