Staff Product Security Engineer Jobs
Staff Product Security Engineer jobs are open across fintech, enterprise software, cloud infrastructure, and healthtech, with specializations in application security engineering, threat modeling, and security architecture, from senior engineer to principal and staff levels. Scan the live roles below and apply to whichever ones fit.
Find JobsLooking for remote work? View remote staff product security engineer jobs →Overview
Showing 5 of 47+ Staff Product Security Engineer jobs
About Flexport:
At Flexport, we believe global trade can move the human race forward. That's why it's our mission to make global commerce so easy there will be more of it. We're shaping the future of a $10T industry with solutions powered by innovative technology and exceptional people. Today, companies of all sizes—from emerging brands to Fortune 500s—use Flexport technology to move more than $19B of merchandise across 112 countries a year.
The recent global supply chain crisis has put Flexport center stage as we continue to play a pivotal role in how goods move around the world. We are proud to have the support of the best investors in the game who believe in our mission, solutions and people. Ready to tackle global challenges that impact business, society, and the environment? Come join us.
What You'll Do
- Architecture & strategy
- Define security architecture for Flexport's products and services, and set the patterns and reference implementations that make secure-by-default the path of least resistance.
- Lead security engineering reviews for the highest-risk product features, and set the bar for what "good" looks like in reviews you don't personally run.
- Build and scale the security champions program and product security training that extend your judgment into teams where you can't be in every review.
- Design-time & review
- Lead domain-specific threat modeling and attack surface analysis across Flexport's product surface, not just individual features.
- Partner with engineering leadership to resolve the design tradeoffs that a senior engineer would escalate.
- Vulnerability management
- Set the bar for how the team triages, reproduces, and prioritizes bug bounty submissions and internal security reports, and step in on the hardest or highest-severity cases.
- Drive remediation of systemic classes of vulnerability, not just individual findings.
- Developer enablement & leadership
- Own the security services and tooling consumed by product teams across our global infrastructure.
- Mentor other engineers on the team, and act as the authoritative technical voice on product security across engineering leadership.
You Should Have
- Typically 8+ years of experience in product/application security, with real hands-on time building security tools and services, not just reviewing them — we care more about what you've built than the exact number.
- A track record of designing security architecture that scales across many teams and services, not just securing a single product.
- Strong grasp of web application security principles and hands-on experience with application testing tools (Burp Suite, OWASP ZAP, or similar)
- Software development experience building security tools in at least one modern language (Go, Python, Java/Kotlin, TypeScript, Ruby, or similar)
- Track record of leading multi-team technical initiatives and mentoring engineers into senior roles
Nice to Have
- Experience running or scaling a security champions program
- Identity management and identity federation experience (SAML, OAuth, SCIM)
- Experience with IaaS cloud infrastructure, Kubernetes, containers, and service-oriented architectures
- Hands-on experience with bug bounty platforms and SAST tools (Cycode, Semgrep, Snyk, or similar)
- Experience performing code audits on internal or open-source libraries before they ship in production
How We Work
- We stay closely aligned with teammates on other continents via Slack, video, and async docs
- We have the latest hardware and software, including frontier AI models on day one
- We're agile, but not dogmatic — the team decides how it works best
Why This Role Is Special
- Massive leverage: the conventions and champions program you build are multiplied across hundreds of engineers who never talk to you directly.
- Broad authority: you set the architecture other reviews are measured against, rather than being the one measured.
- You're part of PSI: the platform, security, and infrastructure teams work hand in hand, and security is treated as infrastructure with real engineering quality bars, not a policy function.
#LI-Remote
#LI-VA1
Commitment to Equal Opportunity
At Flexport, our ability to fulfill our mission of making global commerce easy and accessible relies on having a diverse, dedicated and engaged workforce. All qualified applicants will receive consideration for employment regardless of race, color, religion, sex, national origin, age, physical and mental disability, health status, marital and family status, sexual orientation, gender identity and expression, military and veteran status, and any other characteristic protected by applicable law.
Global Data Privacy Notice for Job Candidates and Applicants
Depending on your location, the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA) may regulate the way we manage the data of job applicants. By submitting your application, you are agreeing to our use and processing of your data as required. Please see our Privacy Notice available at www.flexport.com/privacy for additional information.
About Flexport:
At Flexport, we believe global trade can move the human race forward. That's why it's our mission to make global commerce so easy there will be more of it. We're shaping the future of a $10T industry with solutions powered by innovative technology and exceptional people. Today, companies of all sizes—from emerging brands to Fortune 500s—use Flexport technology to move more than $19B of merchandise across 112 countries a year.
The recent global supply chain crisis has put Flexport center stage as we continue to play a pivotal role in how goods move around the world. We are proud to have the support of the best investors in the game who believe in our mission, solutions and people. Ready to tackle global challenges that impact business, society, and the environment? Come join us.
What You'll Do
- Architecture & strategy
- Define security architecture for Flexport's products and services, and set the patterns and reference implementations that make secure-by-default the path of least resistance.
- Lead security engineering reviews for the highest-risk product features, and set the bar for what "good" looks like in reviews you don't personally run.
- Build and scale the security champions program and product security training that extend your judgment into teams where you can't be in every review.
- Design-time & review
- Lead domain-specific threat modeling and attack surface analysis across Flexport's product surface, not just individual features.
- Partner with engineering leadership to resolve the design tradeoffs that a senior engineer would escalate.
- Vulnerability management
- Set the bar for how the team triages, reproduces, and prioritizes bug bounty submissions and internal security reports, and step in on the hardest or highest-severity cases.
- Drive remediation of systemic classes of vulnerability, not just individual findings.
- Developer enablement & leadership
- Own the security services and tooling consumed by product teams across our global infrastructure.
- Mentor other engineers on the team, and act as the authoritative technical voice on product security across engineering leadership.
You Should Have
- Typically 8+ years of experience in product/application security, with real hands-on time building security tools and services, not just reviewing them — we care more about what you've built than the exact number.
- A track record of designing security architecture that scales across many teams and services, not just securing a single product.
- Strong grasp of web application security principles and hands-on experience with application testing tools (Burp Suite, OWASP ZAP, or similar)
- Software development experience building security tools in at least one modern language (Go, Python, Java/Kotlin, TypeScript, Ruby, or similar)
- Track record of leading multi-team technical initiatives and mentoring engineers into senior roles
Nice to Have
- Experience running or scaling a security champions program
- Identity management and identity federation experience (SAML, OAuth, SCIM)
- Experience with IaaS cloud infrastructure, Kubernetes, containers, and service-oriented architectures
- Hands-on experience with bug bounty platforms and SAST tools (Cycode, Semgrep, Snyk, or similar)
- Experience performing code audits on internal or open-source libraries before they ship in production
How We Work
- We stay closely aligned with teammates on other continents via Slack, video, and async docs
- We have the latest hardware and software, including frontier AI models on day one
- We're agile, but not dogmatic — the team decides how it works best
Why This Role Is Special
- Massive leverage: the conventions and champions program you build are multiplied across hundreds of engineers who never talk to you directly.
- Broad authority: you set the architecture other reviews are measured against, rather than being the one measured.
- You're part of PSI: the platform, security, and infrastructure teams work hand in hand, and security is treated as infrastructure with real engineering quality bars, not a policy function.
#LI-Remote
#LI-VA1
Commitment to Equal Opportunity
At Flexport, our ability to fulfill our mission of making global commerce easy and accessible relies on having a diverse, dedicated and engaged workforce. All qualified applicants will receive consideration for employment regardless of race, color, religion, sex, national origin, age, physical and mental disability, health status, marital and family status, sexual orientation, gender identity and expression, military and veteran status, and any other characteristic protected by applicable law.
Global Data Privacy Notice for Job Candidates and Applicants
Depending on your location, the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA) may regulate the way we manage the data of job applicants. By submitting your application, you are agreeing to our use and processing of your data as required. Please see our Privacy Notice available at www.flexport.com/privacy for additional information.
Staff Product Security Engineer Jobs by Experience Level
See All 47 Staff Product Security Engineer Jobs
Find roles that match your experience and apply in just a few clicks.
Find JobsStaff Product Security Engineer Job Market
Who's Hiring
Top Industries Hiring
- Technology & Software
- Retail
- Science & Research
- Banking & Financial Services
- Non-Profit & Social Services
What Employers Look For
The qualifications that appear most often in staff product security engineer jobs.
- 7 or more years of experience in product security or application security engineering
- Deep proficiency in threat modeling methodologies such as STRIDE or PASTA
- Hands-on experience with secure SDLC design and security review processes
- Proficiency in one or more programming languages such as Python, Go, or Java
- Experience conducting security design reviews for cloud-native or distributed systems
- Relevant certification such as CISSP, OSCP, or equivalent security credential preferred
Tips for Your Staff Product Security Engineer Job Search
Tailor your resume to threat modeling depth
Staff-level security engineers are expected to own threat modeling end to end. Highlight specific frameworks you've applied, such as STRIDE or PASTA, and name the product surfaces you secured, not just that you performed assessments.
Distinguish architecture from implementation work
Hiring managers at the staff level screen for candidates who set security direction, not just execute tickets. Explicitly separate design decisions you led from hands-on remediation work so reviewers don't underread your seniority.
Apply early to roles that fit
Migrate Mate lists staff product security engineer openings from across the United States in one place, so you can find roles that match and apply directly to each listing.
Filter openings by product scope not just title
A staff product security engineer at a payments company and one at a consumer app face completely different attack surfaces. Read job descriptions for the product surface you have the deepest experience securing before you apply.
Prepare a cross-functional influence story for interviews
Staff engineers are grilled on how they drive security without direct authority. Prepare two or three concrete examples of persuading an engineering or product team to adopt a security control they initially resisted.
Negotiate scope alongside compensation
At the staff level, what you own matters as much as what you earn. During offer conversations, clarify which product teams report security decisions to you and whether you have input on the security roadmap before you accept.
Staff Product Security Engineer Jobs: Frequently Asked Questions
Which companies are hiring the most staff product security engineers?
ServiceNow, Modus Closing, and Flexport are hiring the most staff product security engineers right now, with openings concentrated in California, New York, and Washington, based on current listings on Migrate Mate as of November 2026. Demand is especially strong at companies scaling regulated products in fintech, healthcare technology, and enterprise cloud.
How many staff product security engineer jobs are remote?
About 89% of staff product security engineer openings are fully remote or hybrid as of November 2026, reflecting strong employer flexibility at the staff level. Roles focused on security architecture review, secure SDLC program ownership, and cross-team policy work tend to be the most remote-friendly, while positions requiring hands-on lab or on-site infrastructure access are more likely to require in-person presence.
How do you become a staff product security engineer?
Start by building a foundation in application security through senior or lead security engineering roles where you own security reviews for entire product lines. Develop fluency in threat modeling, secure SDLC design, and cross-functional influence. Progress by demonstrating that you can set security strategy across engineering teams, not just execute it, and pair that experience with a recognized security certification to signal depth.
Can you get hired as a staff product security engineer without direct staff-level experience?
Some candidates move into staff roles by demonstrating staff-level impact at a lower title, particularly in smaller companies where scope outpaces title. Document ownership of security architecture decisions, programs you built from scratch, and situations where you influenced product direction without formal authority. A strong portfolio of threat models, security design reviews, and measurable outcomes can offset an absence of a previous staff-level title.
What does the staff product security engineer interview process look like?
Most processes include an initial screening call, a technical interview focused on threat modeling and secure design scenarios, and a cross-functional or systems design round that tests how you apply security judgment to real product constraints. Final rounds typically involve a presentation or case study where you propose a security program or architecture, followed by a leadership or values interview with engineering and product partners.
Where can I find and apply to staff product security engineer jobs?
You can find and apply to staff product security engineer jobs on Migrate Mate, which lists current openings from across the United States. Search the listings to find roles that match your background, product focus, and preferred location or remote arrangement, then apply directly to each listing that fits.
See All 47 Staff Product Security Engineer Jobs
Find roles that match your experience and apply in just a few clicks.
Find Jobs