Flexport
Senior Security Engineer, Detection & Response
$138K–$252K
U.S. Remote +1 · Remote · Senior · Full-time · Posted Aug 28, 2026
- Location
- U.S. Remote
San Francisco, California, United States - Experience
- Typically 5–8 years; the posting says the exact number matters less than what candidates have built.
About the job
Own end-to-end security detection engineering and incident response, including building detections, improving telemetry, and automating investigations across Flexport’s systems.
What you'll do
- Build, tune, and measure detections across endpoint, identity, SaaS, and cloud.
- Lead incident response from triage through remediation, and create retrospectives that drive systemic fixes.
- Define telemetry requirements, hunt for threats, and build automation to reduce investigation toil.
What they ask for
- Hands-on detection engineering, incident response, or threat-hunting experience, including writing and tuning detections.
- Proficiency in at least one programming language, such as Python or Go, and ability to write production-grade detection and automation code.
- Experience with a modern SIEM or detection pipeline and shipping and tuning production detection logic.
- Practical incident response experience leading or playing a major role in real incidents.
Nice to have
- Experience with detections as code, CI/CD, peer review, and staged rollout; or defining telemetry contracts before systems ship.
- Experience verifying AI-assisted work, cloud-native or Kubernetes telemetry, or fraud or financial-crime detection patterns.
Pay
$138,196 — $252,000 USD base salary (California); $183,272 — $229,091 USD base salary (Washington); $138,196 — $172,746 USD base salary (Colorado); $183,272 — $229,091 USD base salary (New York City); $138,196 — $172,746 USD base salary (Illinois)
Tools
Python, Go, Panther, Elastic, Splunk, MITRE ATT&CK, CI/CD, Kubernetes
AI focus
The role involves critically evaluating and verifying AI-assisted work; the company also provides frontier AI models.
Model-written summary · the original posting is authoritative