Senior Security Engineer, Detection & Response

Flexport · San Francisco, California, United Statessenior

In short

▸Ingeniero de seguridad senior que crea, ajusta y responde detecciones en todo el entorno (endpoint, identidad, cloud, SaaS).
▸Trabaja con CI/CD, automatización y telemetría proactiva; no hay soporte tier-1 ni paged a horas nocturnas.
▸Destaca por tener responsabilidad total sobre detecciones desde desarrollo hasta post-incidente, con enfoque en calidad medible.

Proficiency in English is required for collaboration across global teams.

In ~1 minute you get: who interviews you, the likely questions answered from your CV, and your CV tailored to this job. Free, no card.

What they ask for

✓5-8 años en ingeniería de detecciones, respuesta a incidentes o caza de amenazas.
✓Dominio de al menos un lenguaje de programación (Python, Go o similar).
✓Experiencia comprobada en SIEM o pipeline de detección (Panther, Elastic, Splunk, etc.).
✓Experiencia práctica en respuesta a incidentes reales, incluyendo triaje, contención y cierre.
✓Capacidad para definir requisitos de telemetría antes del lanzamiento de sistemas.
✓Capacidad para evaluar críticamente el trabajo asistido por IA, validando resultados.

Don't tick every box? That's normal — your free dossier shows your gaps and how to cover them in the interview.

PythonGoPantherElasticSplunkCI/CDversion controlSIEMdetections as codetelemetry contracts

Who should you write to at Flexport?

Your free dossier identifies the people who'd interview you — their background, what they value, and how to reach out so you stand out before applying.

About Flexport: At Flexport, we believe global trade can move the human race forward. That’s why it’s our mission to make global commerce so easy there will be more of it. We’re shaping the future of a $10T industry with solutions powered by innovative technology and exceptional people. Today, companies of all sizes—from emerging brands to Fortune 500s—use Flexport technology to move more than $19B of merchandise across 112 countries a year. The recent global supply chain crisis has put Flexport center stage as we continue to play a pivotal role in how goods move around the world. We are proud to have the support of the best investors in the game who believe in our mission, solutions and people. Ready to tackle global challenges that impact business, society, and the environment? Come join us. What you'll do There is no MSSP and no tier-1 queue here. Detection & Response engineers own their detections end to end: you write them, you tune them, and your team is paged when they fire. The security team is spread across the globe with a follow-the-sun pager rotation so nobody is paged at 3am local. The adversaries are real. The business is growing fast and the threat surface is growing with it. Defining the necessary telemetry is part of the job. Detection engineering • Build and tune detections across endpoint, identity, SaaS, and cloud , treating them as software: version-controlled, peer-reviewed, and shipped through the same CI/CD practices the rest of engineering uses. • Track detection quality as measured quantities : coverage against MITRE ATT&CK, precision, time-to-detect. We don’t build-and-forget here. Response & automation • Own incident response: triage, contain, remediate, and write the retrospective that turns the incident into a systemic fix. • Build automation that removes toil from investigations, and partner closely with the US-based team so context carries across time zones instead of getting lost at handoff. Telemetry & partnership • Define telemetry requirements for new systems before they ship , working with infrastructure and product teams to close visibility gaps rather than discovering them during an incident. • Threat hunt proactively across the estate , converting hypotheses into either new detections or documented coverage. You Should Have • Typically 5–8 years of experience in detection engineering, incident response, or threat hunting, with real hands-on time writing and tuning detections. We care more about what you've built than the exact number. • Proficiency in at least one programming language (Python, Go, or similar) and comfort writing production-grade detection and automation code. • Experience with a modern SIEM or detection pipeline (Panther, Elastic, Splunk, or similar). What matters is that you've shipped and tuned detection logic in production. • Practical incident response experience : you've led or played a major role in triaging and closing out real security incidents. Nice to have • Experience treating detections as code with CI/CD, peer review, and staged rollout. • Experience defining telemetry contracts for systems before they ship, rather than retrofitting logging after an incident. • A track record of critically evaluating and verifying AI-assisted work - testing, source-checking, validation - rather than trusting agent output by default. If you haven’t already spotted the em dashes in this job description and already thought about where the hiring manager (hi!) has put hands on keyboard and compared that to where they let the

Don't apply unprepared

We research who's interviewing you, tailor your CV and rehearse you live — first one free.