Product Security Engineer II — Secure-by-Default Tools

Flexport; Amsterdam; Hybrid; EUR 70,000 - 110,000; Full time

Benefits offered by this job

Health insurance

Lunches provided

Commuting expenses coverage

Vacation days

Pension plan

Equity program

Employee Assistance Program

Parental leave

Job summary

Flexport is seeking a Product Security Engineer II to help Flexport establish itself as the most trusted company in the global trade ecosystem. As a Product Security Engineer, you’ll develop a deep understanding of product development and strategy, and will be able to quickly identify and communicate security risks to diverse audiences while offering alternative solutions.

All security disciplines work under the umbrella of the combined PSI (Platform, Security & Infrastructure) team: we build

Qualifications

• 2–5 years of experience in product/application security or software development with a security focus.
• Strong grasp of web application security principles and common attack vectors (e.g., OWASP Top 10).
• Proficiency with application testing tools such as Burp Suite, OWASP ZAP, or browser developer tools.
• Working knowledge of at least one modern programming language (e.g., Ruby, Java/Kotlin, TypeScript/JavaScript, Python).
• Working knowledge of at least one major cloud provider (AWS, GCP, Azure).
• Hands‑on experience with SAST tools (Cycode, Semgrep, Snyk, or similar).
• Experience improving developer experience (DevEx) security without slowing teams down.
• Clear, constructive communicator on technical risk - in writing, in code review, and in conversation.
• Collaborative by default: you partner with developers, SREs, and security peers rather than handing down mandates.
• Comfortable with security on‑call rotation and picking up work across security disciplines when needed.

Responsibilities

• Build guardrails and AI-accelerated patterns that make secure-by-default the path of least resistance for developers.
• Build and maintain security tooling and automation that scales product security.
• Respond to emerging threats.
• Contribute to threat modeling, design reviews, and code reviews with pragmatic guidance that balances risk against velocity.
• Partner with engineering to security-review and test new features and services as they're built.
• Triage, reproduce, and validate incoming bug bounty submissions and internal security reports.
• Cut through SAST, secrets, and vulnerability scanner noise to prioritize real issues and guide developers to effective fixes.
• Partner with development teams to drive remediation and track issues through closure.
• Write clear, actionable security patterns that let developers ship fast and stay secure.
• Write and maintain runbooks, developer guidelines, and security documentation that scale the team's practices.
• Stay current on web and cloud security trends and bring new findings into product discussions.

Skills

Web security

OWASP Top 10

Burp Suite

OWASP ZAP

Java

Kotlin

TypeScript

JavaScript

Python

AWS

GCP

Azure

SAST tools

DevEx security

Communication

On-call

Collaborative

Tools

Burp Suite

OWASP ZAP

SAST tools

Job description

Flexport is seeking a Product Security Engineer II to help Flexport establish itself as the most trusted company in the global trade ecosystem. As a Product Security Engineer, you’ll develop a deep understanding of product development and strategy, and will be able to quickly identify and communicate security risks to diverse audiences while offering alternative solutions.

All security disciplines work under the umbrella of the combined PSI (Platform, Security & Infrastructure) team: we build