Senior Security Engineer, Detection & Response

Flexport is hiring a Senior Security Engineer, Detection & Response to own security detections end to end, from development and tuning through incident response. The role also builds investigation automation, defines telemetry requirements, and proactively threat hunts across endpoint, identity, SaaS, and cloud environments.

Responsibilities:

• Build and tune detections across endpoint, identity, SaaS, and cloud, treating them as software: version-controlled, peer-reviewed, and shipped through the same CI/CD practices the rest of engineering uses
• Track detection quality as measured quantities: coverage against MITRE ATT&CK, precision, time-to-detect. We don’t build-and-forget here
• Own incident response: triage, contain, remediate, and write the retrospective that turns the incident into a systemic fix
• Build automation that removes toil from investigations, and partner closely with the US-based team so context carries across time zones instead of getting lost at handoff
• Define telemetry requirements for new systems before they ship, working with infrastructure and product teams to close visibility gaps rather than discovering them during an incident
• Threat hunt proactively across the estate, converting hypotheses into either new detections or documented coverage

Requirements:

• Typically 5–8 years of experience in detection engineering, incident response, or threat hunting, with real hands-on time writing and tuning detections. We care more about what you've built than the exact number
• Proficiency in at least one programming language (Python, Go, or similar) and comfort writing production-grade detection and automation code
• Experience with a modern SIEM or detection pipeline (Panther, Elastic, Splunk, or similar). What matters is that you've shipped and tuned detection logic in production
• Practical incident response experience: you've led or played a major role in triaging and closing out real security incidents
• Experience treating detections as code with CI/CD, peer review, and staged rollout
• Experience defining telemetry contracts for systems before they ship, rather than retrofitting logging after an incident
• A track record of critically evaluating and verifying AI-assisted work - testing, source-checking, validation - rather than trusting agent output by default
• Familiarity with cloud-native and Kubernetes telemetry
• Experience with fraud or financial-crime detection patterns