Security Engineer

📋 Job Overview

This is Flox’s first dedicated security hire. You’ll work directly with engineering leadership to stand up security practices that are pragmatic, developer-friendly, and right-sized for a company at our stage. The role is heavily weighted toward doing—you’ll be the one deploying tools, configuring controls, hardening infrastructure, and closing gaps, not just advising others to do so.

That said, you’ll have real input into how we think about controls, priorities, and our security roadmap as we grow. And because our product sits at the heart of the software supply chain—managing dependencies, environments, and build artifacts for some of the world’s largest engineering teams—security isn’t peripheral here. It’s core to the value we deliver.

If you want to build something from scratch, own it end-to-end, and have your work matter immediately, this is that job. If you want a large team, an existing program to slot into, or mostly governance work, it probably isn’t.

🏢 About Flox

Flox is a company that manages dependencies, environments, and build artifacts for some of the world’s largest engineering teams.

🎯 The Role

You’ll work directly with engineering leadership to stand up security practices that are pragmatic, developer-friendly, and right-sized for a company at our stage. You’ll be the one deploying tools, configuring controls, hardening infrastructure, and closing gaps, not just advising others to do so.

✅ Key Responsibilities

• Help evaluate whether to stand up an internal SIEM or work with an outsourced SOC provider—then implement whichever path makes sense for where we are as a company.
• Build incident response runbooks and triage workflows—then actually test them (e.g. test backups in case needed for ransomware recovery).
• Scan and harden our AWS posture hands-on: IAM policies, SCPs, security group hygiene, GuardDuty, Security Hub, and automated compliance guardrails need to be evaluated and maintained.
• Own Cloudflare configuration across WAF rules, DDoS protection, bot management, Zero Trust access, and DLP policies—keeping rules current and tuned as the product evolves.
• Deploy and manage endpoint protection across developer systems and production endpoints—covering EDR, device posture, behavior monitoring (including dynamic scans), DLP, and threat detection.
• Secure our build and release pipelines.
• Integrate SAST and SCA tooling (Semgrep, Snyk, GitHub Advanced Security) into developer workflows.
• Audit and rationalize IAM across AWS, Cloudflare, SaaS applications, and internal tooling; implement the fixes, not just the findings.
• Build a lightweight, repeatable access review process—something that actually runs on a cadence and produces real decisions.

📌 Required Qualifications

• 3–5 years of hands-on security engineering experience, ideally at a software company or cloud-native environment.
• A demonstrable track record of implementing security tools and controls, not just scoping or recommending them.
• Solid working knowledge of AWS security services: IAM, SCPs, GuardDuty, Security Hub, CloudTrail, and related tooling.
• Hands-on experience with Cloudflare—WAF rule management, Zero Trust, DLP, or similar; comfort learning what you haven’t used yet.
• Experience deploying and managing endpoint protection (EDR/MDM) across a mixed developer and production environment.
• Familiarity with software supply chain concepts: SBOMs, dependency management, artifact signing, SLSA.
• Experience integrating SAST, SCA, or DAST tools into CI/CD pipelines.
• Comfort with scripting or light automation (Python, Bash, or similar) to build repeatable processes.
• Ability to work independently, ruthlessly prioritize, and operate without a playbook.
• The kind of person who is bothered when something is insecure and doesn’t wait for someone else to fix it.

⭐ Desirable Experience

• Familiarity with Nix, package management, or reproducible build systems.
• Experience evaluating or managing an outsourced SOC relationship.
• Prior SIEM deployment or detection engineering experience.
• Experience supporting a SOC 2 or ISO 27001 audit.
• Security certifications (CISSP, OSCP, AWS Security Specialty, etc.).

🎁 Benefits

Salary: $160K – $210K • Offers Equity

🛂 Visa & Eligibility