{"id":475260,"url":"https://alion.io/job/floxdevelopment-security-engineer","title":"Security Engineer","company":{"id":183444,"name":"Flox","domain":"flox.dev","url":"https://alion.io/company/floxdevelopment","size_band":"51-200","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":null},"role":"Security","role_family":"Security","seniority":"middle","employment_type":"full_time","work_mode":"remote","remote_scope":"stated_countries","remote_scope_basis":"board_field","remote_working_hours":null,"hiring_geo_confidence":"structured","locations":[],"countries":[],"hiring_countries":["US"],"hiring_countries_total":1,"salary":{"min":160000,"max":210000,"currency":"USD","period":"year","gross":null,"usd_annual":210000},"salary_estimate":null,"experience_years_min":3,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AWS","optional":false},{"name":"Checkov","optional":false},{"name":"CI/CD","optional":false},{"name":"Cloudflare","optional":false},{"name":"Defense in Depth","optional":false},{"name":"DLP","optional":false},{"name":"GitHub","optional":false},{"name":"IAM","optional":false},{"name":"Least Privilege","optional":false},{"name":"Python","optional":false},{"name":"Semgrep","optional":false},{"name":"SIEM","optional":false},{"name":"SLSA","optional":false},{"name":"Snyk","optional":false},{"name":"tfsec","optional":false},{"name":"Threat Modeling","optional":false},{"name":"Zero Trust","optional":false},{"name":"ISO 27001","optional":true},{"name":"SOC 2","optional":true}],"status":"live","first_seen_at":"2026-04-28T14:59:28Z","employer_posted_date":"2026-04-28","last_verified_at":"2026-11-03T03:38:25Z","board_verified":true,"closed_at":null,"days_open":188,"trust":{"level":"stale","repost_count":0,"flags":["stale"],"days_open":188},"description":"THE ROLE\nThis is Flox’s first dedicated security hire. You’ll work directly with engineering leadership to stand up security practices that are pragmatic, developer-friendly, and right-sized for a company at our stage. The role is heavily weighted toward doing-you’ll be the one deploying tools, configuring controls, hardening infrastructure, and closing gaps, not just advising others to do so.\nThat said, you’ll have real input into how we think about controls, priorities, and our security roadmap as we grow. And because our product sits at the heart of the software supply chain-managing dependencies, environments, and build artifacts for some of the world’s largest engineering teams-security isn’t peripheral here. It’s core to the value we deliver.\nIf you want to build something from scratch, own it end-to-end, and have your work matter immediately, this is that job. If you want a large team, an existing program to slot into, or mostly governance work, it probably isn’t.\nWHAT YOU’LL DO\nDetection, Monitoring & Response\nHelp evaluate whether to stand up an internal SIEM or work with an outsourced SOC provider-then implement whichever path makes sense for where we are as a company. If building internally: deploy and configure the SIEM, write and tune detection rules, and own the alerting stack. If outsourcing: manage the SOC relationship, define what gets escalated and how, and ensure we’re getting signal not just noise\n\nBuild incident response runbooks and triage workflows-then actually test them (e.g. test backups in case needed for ransomware recovery)\n\nBe the person who sees something and does something about it\n\nCloud & Infrastructure Security (AWS + Cloudflare)\nScan and harden our AWS posture hands-on: IAM policies, SCPs, security group hygiene, GuardDuty, Security Hub, and automated compliance guardrails need to be evaluated and maintained\n\nOwn Cloudflare configuration across WAF rules, DDoS protection, bot management, Zero Trust access, and DLP policies-keeping rules current and tuned as the product evolves\n\nImplement IaC security scanning (Checkov, tfsec, or similar) directly into CI/CD pipelines\n\nOwn CSPM tooling-configure it, triage it, fix things, don’t just generate reports\n\nEndpoint Protection\nDeploy and manage endpoint protection across developer systems and production endpoints-covering EDR, device posture, behavior monitoring (including dynamic scans), DLP, and threat detection\n\nEnsure developer machines (Mac-heavy environment typical of engineering teams) meet baseline security standards while minimizing friction that slows people down. Understand when and where detective controls suffice vs preventative controls based on thoughtful risk management and defense in depth\n\nDefine and enforce endpoint compliance policies, including disk encryption, patch posture, and application controls\n\nWork with engineering to extend endpoint visibility into production infrastructure where applicable\n\nSoftware Supply Chain\nSecure our build and release pipelines\n\nConsider SLSA framework adoption and supply chain integrity attestations for our catalog and environments\n\nStand up dependency vulnerability scanning and own the remediation workflow end-to-end for third-party services, libraries, middleware, operating systems, and SaaS\n\nApplication Security\nIntegrate SAST and SCA tooling (Semgrep, Snyk, GitHub Advanced Security) into developer workflows\n\nParticipate in security design reviews and threat modeling for new features\n\nWork shoulder-to-shoulder with developers to find and fix vulnerabilities using a risk-based model instead of just vulnerability aging reports\n\nIdentity, Access & Entitlements\nThis is a priority area-but implemented right for a company at our size, not over-engineered for a company ten times larger.\nAudit and rationalize IAM across AWS, Cloudflare, SaaS applications, and internal tooling; implement the fixes, not just the findings\n\nDrive SSO consolidation, enforce MFA universally, and implement least-privilege access in practice, not just policy\n\nBuild a lightweight, repeatable access review process-something that actually runs on a cadence and produces real decisions\n\nOwn joiner/mover/leaver processes so that entitlements stay clean as the team grows\n\nEvaluate and implement an appropriate identity governance solution for our stage-not an enterprise IGA platform, but something that gives us control and auditability\n\nWHAT WE’RE LOOKING FOR\n3-5 years of hands-on security engineering experience, ideally at a software company or cloud-native environment\n\nA demonstrable track record of implementing security tools and controls, not just scoping or recommending them\n\nSolid working knowledge of AWS security services: IAM, SCPs, GuardDuty, Security Hub, CloudTrail, and related tooling\n\nHands-on experience with Cloudflare-WAF rule management, Zero Trust, DLP, or similar; comfort learning what you haven’t used yet\n\nExperience deploying and managing endpoint protection (EDR/MDM) across a mixed developer and production environment\n\nFamiliarity with software supply chain concepts: SBOMs, dependency management, artifact signing, SLSA\n\nExperience integrating SAST, SCA, or DAST tools into CI/CD pipelines\n\nComfort with scripting or light automation (Python, Bash, or similar) to build repeatable processes\n\nAbility to work independently, ruthlessly prioritize, and operate without a playbook\n\nThe kind of person who is bothered when something is insecure and doesn’t wait for someone else to fix it\n\nNICE TO HAVE\nFamiliarity with Nix, package management, or reproducible build systems\n\nExperience evaluating or managing an outsourced SOC relationship\n\nPrior SIEM deployment or detection engineering experience\n\nExperience supporting a SOC 2 or ISO 27001 audit\n\nSecurity certifications (CISSP, OSCP, AWS Security Specialty, etc.)\n\nWHY FLOX\nFirst dedicated security hire-you’ll build the program, not inherit someone else’s backlog\n\nA product developers genuinely love, which makes working with the engineering team easier\n\nSmall team, short feedback loops, real ownership-your work will be visible immediately\n\nCompetitive salary, meaningful equity in a well-funded company, and a flexible hybrid environment","description_format":"text","description_chars":6202,"description_truncated":false,"requirements":{"experience_years_min":3,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity"],"hiring_locations":[{"name":"United States","iso":"US","kind":"country"}],"hiring_excludes":[],"relocation_offered":false,"industries":["DevOps & Platform Engineering","Custom Software Development"],"lifecycle":[{"event":"open","at":"2026-09-06T14:24:44Z"}],"visa":[],"liveness":{"score":3,"band":"cold","label":"Long shot","p_open":1,"p_active":0.124,"p_room":0.28,"age_days":188,"expected_fill_days":35,"reasons":["conf:2","win:tail","crowd:"],"computed_at":"2026-11-03T05:54:40Z"},"pay":{"stated_usd_annual":210000,"is_top_pay":true},"html_url":"https://alion.io/job/floxdevelopment-security-engineer","json_url":"https://alion.io/job/floxdevelopment-security-engineer.json","meta":{"generated_at":"2026-11-03T06:33:29Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":9062,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-04T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":183444},"rest":"https://alion.io/mcp/rest/get_company?id=183444"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Ffloxdevelopment-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Ffloxdevelopment-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Ffloxdevelopment-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/floxdevelopment-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Ffloxdevelopment-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":475260}},{"tool":"search_jobs","arguments":{"company":"flox.dev","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":475260},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}