Senior Security Engineer, Detection & Response

Flexport is a global trade technology company. The Senior Security Engineer, Detection & Response will own detections end to end, build and tune detections across endpoint, identity, SaaS, and cloud, and lead incident response. The role is based in San Francisco.

• Build and tune detections across endpoint, identity, SaaS, and cloud, treating them as software: version-controlled, peer-reviewed, and shipped through the same CI/CD practices the rest of engineering uses.
• Track detection quality as measured quantities: coverage against MITRE ATT&CK, precision, time-to-detect.
• Own incident response: triage, contain, remediate, and write the retrospective that turns the incident into a systemic fix.
• Build automation that removes toil from investigations, and partner closely with the US-based team so context carries across time zones instead of getting lost at handoff.
• Define telemetry requirements for new systems before they ship, working with infrastructure and product teams to close visibility gaps rather than discovering them during an incident.
• Threat hunt proactively across the estate, converting hypotheses into either new detections or documented coverage.

• Typically 5–8 years of experience in detection engineering, incident response, or threat hunting, with real hands-on time writing and tuning detections.
• Proficiency in at least one programming language (Python, Go, or similar) and comfort writing production-grade detection and automation code.
• Experience with a modern SIEM or detection pipeline (Panther, Elastic, Splunk, or similar).
• Practical incident response experience: you've led or played a major role in triaging and closing out real security incidents.

• You own your detections end to end, no MSSP, no tier-1 queue, no handing your work to someone else to triage.
• The consequences here are physical, not abstract: a containment decision can stop a customs filing or freight actually moving, which makes the stakes concrete in a way a SaaS control plane rarely is.
• You'll inherit a real, established estate with legacy telemetry gaps to close, genuinely underexplored surface area, not a well-mined problem.
• We have the latest hardware and software, including frontier AI models on day one.
• We're agile, but not dogmatic.
• Base salary is just one part of our total rewards package at Flexport, which also includes bonus, equity, and comprehensive benefit offerings such as medical, dental, and flexible time off.