Remote Staff Security Engineer Jobs
Remote staff security engineer jobs are open across cloud, fintech, healthcare technology, and enterprise software sectors, where distributed security teams have become the norm. Remote-first companies, publicly traded tech firms, and security-focused startups are actively hiring, with roles ranging from senior individual contributor to staff-level technical leadership. Employers hiring remotely right now include ServiceNow, GitHub, and DoorDash. See the openings below and apply to the ones that match your experience.
Find JobsOverview
Showing 5 of 55+ Remote Staff Security Engineer jobs
About Flexport:
At Flexport, we believe global trade can move the human race forward. That's why it's our mission to make global commerce so easy there will be more of it. We're shaping the future of a $10T industry with solutions powered by innovative technology and exceptional people. Today, companies of all sizes—from emerging brands to Fortune 500s—use Flexport technology to move more than $19B of merchandise across 112 countries a year.
The recent global supply chain crisis has put Flexport center stage as we continue to play a pivotal role in how goods move around the world. We are proud to have the support of the best investors in the game who believe in our mission, solutions and people. Ready to tackle global challenges that impact business, society, and the environment? Come join us.
What You'll Do
- Architecture & strategy
- Define security architecture for Flexport's products and services, and set the patterns and reference implementations that make secure-by-default the path of least resistance.
- Lead security engineering reviews for the highest-risk product features, and set the bar for what "good" looks like in reviews you don't personally run.
- Build and scale the security champions program and product security training that extend your judgment into teams where you can't be in every review.
- Design-time & review
- Lead domain-specific threat modeling and attack surface analysis across Flexport's product surface, not just individual features.
- Partner with engineering leadership to resolve the design tradeoffs that a senior engineer would escalate.
- Vulnerability management
- Set the bar for how the team triages, reproduces, and prioritizes bug bounty submissions and internal security reports, and step in on the hardest or highest-severity cases.
- Drive remediation of systemic classes of vulnerability, not just individual findings.
- Developer enablement & leadership
- Own the security services and tooling consumed by product teams across our global infrastructure.
- Mentor other engineers on the team, and act as the authoritative technical voice on product security across engineering leadership.
You Should Have
- Typically 8+ years of experience in product/application security, with real hands-on time building security tools and services, not just reviewing them — we care more about what you've built than the exact number.
- A track record of designing security architecture that scales across many teams and services, not just securing a single product.
- Strong grasp of web application security principles and hands-on experience with application testing tools (Burp Suite, OWASP ZAP, or similar)
- Software development experience building security tools in at least one modern language (Go, Python, Java/Kotlin, TypeScript, Ruby, or similar)
- Track record of leading multi-team technical initiatives and mentoring engineers into senior roles
Nice to Have
- Experience running or scaling a security champions program
- Identity management and identity federation experience (SAML, OAuth, SCIM)
- Experience with IaaS cloud infrastructure, Kubernetes, containers, and service-oriented architectures
- Hands-on experience with bug bounty platforms and SAST tools (Cycode, Semgrep, Snyk, or similar)
- Experience performing code audits on internal or open-source libraries before they ship in production
How We Work
- We stay closely aligned with teammates on other continents via Slack, video, and async docs
- We have the latest hardware and software, including frontier AI models on day one
- We're agile, but not dogmatic — the team decides how it works best
Why This Role Is Special
- Massive leverage: the conventions and champions program you build are multiplied across hundreds of engineers who never talk to you directly.
- Broad authority: you set the architecture other reviews are measured against, rather than being the one measured.
- You're part of PSI: the platform, security, and infrastructure teams work hand in hand, and security is treated as infrastructure with real engineering quality bars, not a policy function.
#LI-Remote
#LI-VA1
Commitment to Equal Opportunity
At Flexport, our ability to fulfill our mission of making global commerce easy and accessible relies on having a diverse, dedicated and engaged workforce. All qualified applicants will receive consideration for employment regardless of race, color, religion, sex, national origin, age, physical and mental disability, health status, marital and family status, sexual orientation, gender identity and expression, military and veteran status, and any other characteristic protected by applicable law.
Global Data Privacy Notice for Job Candidates and Applicants
Depending on your location, the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA) may regulate the way we manage the data of job applicants. By submitting your application, you are agreeing to our use and processing of your data as required. Please see our Privacy Notice available at www.flexport.com/privacy for additional information.
About Flexport:
At Flexport, we believe global trade can move the human race forward. That's why it's our mission to make global commerce so easy there will be more of it. We're shaping the future of a $10T industry with solutions powered by innovative technology and exceptional people. Today, companies of all sizes—from emerging brands to Fortune 500s—use Flexport technology to move more than $19B of merchandise across 112 countries a year.
The recent global supply chain crisis has put Flexport center stage as we continue to play a pivotal role in how goods move around the world. We are proud to have the support of the best investors in the game who believe in our mission, solutions and people. Ready to tackle global challenges that impact business, society, and the environment? Come join us.
What You'll Do
- Architecture & strategy
- Define security architecture for Flexport's products and services, and set the patterns and reference implementations that make secure-by-default the path of least resistance.
- Lead security engineering reviews for the highest-risk product features, and set the bar for what "good" looks like in reviews you don't personally run.
- Build and scale the security champions program and product security training that extend your judgment into teams where you can't be in every review.
- Design-time & review
- Lead domain-specific threat modeling and attack surface analysis across Flexport's product surface, not just individual features.
- Partner with engineering leadership to resolve the design tradeoffs that a senior engineer would escalate.
- Vulnerability management
- Set the bar for how the team triages, reproduces, and prioritizes bug bounty submissions and internal security reports, and step in on the hardest or highest-severity cases.
- Drive remediation of systemic classes of vulnerability, not just individual findings.
- Developer enablement & leadership
- Own the security services and tooling consumed by product teams across our global infrastructure.
- Mentor other engineers on the team, and act as the authoritative technical voice on product security across engineering leadership.
You Should Have
- Typically 8+ years of experience in product/application security, with real hands-on time building security tools and services, not just reviewing them — we care more about what you've built than the exact number.
- A track record of designing security architecture that scales across many teams and services, not just securing a single product.
- Strong grasp of web application security principles and hands-on experience with application testing tools (Burp Suite, OWASP ZAP, or similar)
- Software development experience building security tools in at least one modern language (Go, Python, Java/Kotlin, TypeScript, Ruby, or similar)
- Track record of leading multi-team technical initiatives and mentoring engineers into senior roles
Nice to Have
- Experience running or scaling a security champions program
- Identity management and identity federation experience (SAML, OAuth, SCIM)
- Experience with IaaS cloud infrastructure, Kubernetes, containers, and service-oriented architectures
- Hands-on experience with bug bounty platforms and SAST tools (Cycode, Semgrep, Snyk, or similar)
- Experience performing code audits on internal or open-source libraries before they ship in production
How We Work
- We stay closely aligned with teammates on other continents via Slack, video, and async docs
- We have the latest hardware and software, including frontier AI models on day one
- We're agile, but not dogmatic — the team decides how it works best
Why This Role Is Special
- Massive leverage: the conventions and champions program you build are multiplied across hundreds of engineers who never talk to you directly.
- Broad authority: you set the architecture other reviews are measured against, rather than being the one measured.
- You're part of PSI: the platform, security, and infrastructure teams work hand in hand, and security is treated as infrastructure with real engineering quality bars, not a policy function.
#LI-Remote
#LI-VA1
Commitment to Equal Opportunity
At Flexport, our ability to fulfill our mission of making global commerce easy and accessible relies on having a diverse, dedicated and engaged workforce. All qualified applicants will receive consideration for employment regardless of race, color, religion, sex, national origin, age, physical and mental disability, health status, marital and family status, sexual orientation, gender identity and expression, military and veteran status, and any other characteristic protected by applicable law.
Global Data Privacy Notice for Job Candidates and Applicants
Depending on your location, the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA) may regulate the way we manage the data of job applicants. By submitting your application, you are agreeing to our use and processing of your data as required. Please see our Privacy Notice available at www.flexport.com/privacy for additional information.
See All 55 Remote Staff Security Engineer Jobs
Find roles that match your experience and apply in just a few clicks.
Find JobsRemote Staff Security Engineer Job Market
Who's Hiring
Top Industries Hiring
- Technology & Software
- Non-Profit & Social Services
- Construction & Real Estate
What Employers Look For
The qualifications that appear most often in remote staff security engineer jobs.
- 7 or more years of hands-on experience in information security or a related engineering discipline
- Deep expertise in at least one security domain such as cloud security, application security, or detection and response
- Proficiency with cloud platforms including AWS, Azure, or Google Cloud in security contexts
- Relevant certifications such as CISSP, CISM, OSCP, or cloud-provider security specialty credentials
- Experience conducting threat modeling, security architecture reviews, and risk assessments at scale
- Bachelor's degree in computer science, information security, or a closely related technical field
Tips for Your Remote Staff Security Engineer Job Search
Apply early to remote roles that fit
Migrate Mate lists remote staff security engineer openings from across the U.S. in one place, so you can find roles that match your skills and apply directly. Remote postings often fill faster than on-site ones, so moving quickly on a strong match matters.
Prove your async security communication skills
Remote security teams depend on written clarity for incident reports, threat model documentation, and architecture reviews. Prepare writing samples that show you can communicate security risk and remediation decisions to both technical and non-technical audiences without real-time explanation.
Build a public record of security work
Remote employers can't observe you on the floor, so your GitHub activity, CVE disclosures, bug bounty reports, or published security research become your proof of output. A portfolio that shows how you identify and resolve real security problems does more than a resume alone.
Target remote-first companies over remote-optional ones
Remote-first organizations design their engineering and security workflows around distributed teams, which means staff security engineers there get full access to decisions, documentation, and cross-functional work. Remote-optional roles can leave distributed employees at a structural disadvantage for staff-level impact.
Remote Staff Security Engineer Jobs: Frequently Asked Questions
How do I get a remote staff security engineer job?
Remote staff security engineer roles go to candidates who demonstrate strong self-direction and clear written communication alongside deep technical skills. Distributed security teams rely heavily on async collaboration, so employers screen for comfort with Jira, Confluence, Slack, and similar tools. Prioritize roles at remote-first or remote-mature companies, build a visible portfolio of security work such as published CVEs, bug bounty results, or open-source contributions, and practice articulating threat models and architecture decisions in writing.
Which companies hire remote staff security engineers?
Employers currently hiring remote staff security engineers include ServiceNow, GitHub, and DoorDash, per current remote listings on Migrate Mate as of November 2026. Remote staff security engineer roles are most common at remote-first technology companies, distributed fintech firms, cloud-native startups, and enterprise software organizations that maintain fully distributed security and infrastructure teams.
Can you get a remote staff security engineer job with no experience?
Yes, but remote entry-level staff security engineer roles are harder to land because employers expect candidates to operate independently from day one without close in-person supervision. Your strongest path is demonstrating independent output: home lab documentation, capture-the-flag writeups, bug bounty reports, or security-focused open-source contributions. Remote-first companies and startups are more open to candidates who show initiative and self-structured learning over a traditional employment history.
Do you need a degree for remote staff security engineer jobs?
Not always. Remote employers increasingly weigh demonstrated skills and real security work over formal credentials, especially at companies with distributed hiring practices that cast a wider net. Certifications like CISSP, OSCP, or cloud security credentials carry significant weight, and a strong GitHub presence, published research, or a history of responsible disclosure can substitute effectively for a four-year degree in many hiring conversations.
Which industries hire the most remote staff security engineers?
The sectors hiring the most remote staff security engineers are Technology & Software, Non-Profit & Social Services, and Construction & Real Estate, based on current remote listings on Migrate Mate as of November 2026. These industries maintain large distributed teams that require embedded security expertise across engineering, infrastructure, and product, making remote staff security engineers a core part of their talent strategy rather than an exception.
See All 55 Remote Staff Security Engineer Jobs
Find roles that match your experience and apply in just a few clicks.
Find Jobs