Get the chrome extension Senior Software Engineer, Security
Flex
Team & Locations
Flex Fuels Ambition.
About the Role
We're hiring our first security engineers. Both report directly to the CTO.
We want software engineers with security as their superpower, not security specialists who occasionally write code. The distinction matters here. At our size, the only way one person covers a surface this large is to build things that keep working after they move on. A findings queue you work through by hand grows faster than you can close it. A guardrail in the deployment pipeline doesn't.
The work is product and infrastructure security: making the paths that move money hard to attack, and making the secure way to build something also the easy way. The ledger and its write path, card issuing, payouts, and our stablecoin work are the systems that matter most. The job runs in both directions. You'll be in design review early on anything new, and you'll be continuously assessing what we've already shipped, because most of Flex's risk lives in code that exists today. We don't expect you to read the codebase by hand or to keep a findings queue. We expect you to build the automation and repeatable checks that keep assessing it for you, and to spend the time you get back on the golden paths that stop whole classes of problem from arriving again.
There's no security team above you and no CISO. You'd set the standard here, and own the risk decisions that come with it. Day to day, what gets fixed now, what gets mitigated, and what we knowingly accept is your call. The large ones come to the CTO, who you report to directly and who'll back you when the answer is no. Corporate security posture, endpoints, and identity sit with our IT and Corporate Engineering function, and those decisions are theirs to make.
At a company shipping this fast, a security engineer who blocks everything is worse than no security engineer. The answer isn't to wave things through. It's to understand the system, the business context, and the actual risk well enough to find the mitigation that keeps the velocity. Sometimes the answer is still no, and we'd want that to come from a real read of the risk rather than a standard applied by default. Getting engineers to adopt something matters here as much as finding the problem in the first place. The version of this job that works has Security and Engineering solving the problem together.
Compensation: $170,000 - $230,000 a year, depending on experience, plus equity.
What You'll Do
Threat model the paths that move money: the ledger and write path, card issuing, payouts, and the stablecoin work. Do it inside design review on anything that touches money, continuously, not as a quarterly exercise.
Build secure-by-default infrastructure. Infrastructure as Code (IaC) guardrails, CI/CD supply chain integrity, secrets handling, service isolation, and workload IAM.
Build a just-in-time, least-privilege access system for cloud access that makes engineers faster while narrowing what any one credential can do.
Own application security across both new and existing systems. Continuously assess the highest-risk parts of what we've already shipped, and build automated checks and secure defaults into the development lifecycle so the same problems stop arriving. Code review on high-risk paths, dependency and SBOM hygiene, and static and dynamic analysis where it earns its keep. Eliminate whole vulnerability classes; leave the instance-by-instance work to the machines.
Build a golden path that keeps sensitive data out of logs, and the tooling that proves it stayed out.
Run our vulnerability disclosure program end to end, and grow it into a bug bounty when we can triage at that volume. You'd take this over from an engineering leader who's carrying it today.
Scope and manage external penetration tests, and drive the remediation afterwards. We buy offensive testing; you decide what to point it at.
Build security automation, including AI-assisted triage and review, so that two people can cover a surface that usually takes a larger team.
Partner with Engineering, IT and Corporate Engineering, Risk, and Compliance. You'll be technical input on partner security reviews and audits without owning the paperwork.
What Makes You a Great Fit
You're a strong software engineer first. You'd be comfortable in our normal engineering interview loop.
You think like a builder and an attacker at the same time, and you'd rather remove a class of vulnerability than file fifty tickets about it.
You care about developer experience. You've shipped a security tool or control that engineers actually adopted, and you can explain why they adopted it.
You can tell a senior colleague that what they built isn't safe, explain why in plain language, and work alongside them to build a better alternative.
You're comfortable owning problems end to end with limited guidance, and comfortable saying what you need rather than quietly absorbing it.
You make risk-based calls. You have strong opinions about secure defaults, you can tell a real risk from a theoretical one, and you're comfortable deciding something isn't worth fixing right now.
You know you won't personally touch every security problem here, and you don't want to. You build the defaults and the habits that let engineers make good security decisions without you in the room.
You can read a system diagram and find the trust boundary nobody drew.
You write clearly. Much of this job is convincing people in writing, across time zones.
What We're Looking For
Substantial hands-on experience building or securing systems in a fast-moving environment, including a stretch where you were the most senior person doing this work. We care about what you've built, not the year count.
Real software engineering ability in a language we'd ship (Python, Go, TypeScript, or similar). Not scripting alone.
Hands-on cloud infrastructure experience: AWS or GCP, Terraform or equivalent IaC, containers, and CI/CD pipelines you've changed, not only used.
Practical threat modeling on systems with real consequences, and the judgment to know which findings matter.
Experience with secrets management, workload identity, and service-to-service authorization.
Experience handling inbound vulnerability reports, including at least one difficult reporter.
Clear written communication and a bias toward writing things down.
Strongly Preferred
A platform, infrastructure, or DevOps background where you moved toward security by choice. A great infrastructure engineer who wants to do this work will beat a traditional security hire who wants to write policy, every time.
Experience at a small company, or as a founder, where you were the only person who could do this and had to decide what to skip.
Experience running a VDP or bug bounty program, including the triage.
Fintech, payments, or another regulated environment, on the building side.
Experience applying AI or LLM tooling to security work in a way that held up in production.
Certifications like OSCP or OSWE are a signal we'll happily read, but they don't substitute for an engineering track record.
Why Join Us
Originally posted on Himalayas
Senior Security Engineer
AxisCare Home Care Software
Senior Security Engineer
Reports To: Director of Engineering
Summary
AxisCare is hiring a full-time, fully remote Senior Security Engineer to own security and compliance across our SaaS platform, the market-leading product powering the home care industry.
This is not a job where you'll write policies that nobody reads. You'll work directly with product engineering teams, embedded in how we build software, shaping our security posture. You'll own engineering's side of our SOC 2 Type II compliance program, lead us toward HITRUST certification, and keep our AWS infrastructure, Docker pipelines, and PHP/React codebase hardened as we move fast.
We're also building AI-powered products on top of Amazon Bedrock and our own machine learning models, and we use AI heavily in how we develop software. That creates new kinds of risk that most security playbooks don't cover yet. We need someone who's thinking about this already and building the guardrails that agents need to write secure software.
Home care agencies trust us to run their business every day. Their data includes protected health information. We need someone who takes that personally.
What You'll Do
Own AxisCare Engineering's security program as an individual contributor. Continually improve our security standards as threats evolve, strengthen the systems that enforce them, and work directly with engineers to close gaps.
Own engineering's share of SOC 2 Type II compliance: control design, evidence collection, audit prep, and gap remediation. Chart the path toward HITRUST certification, mapping what we already have and building what we don't.
Threat-model our application and infrastructure. We run a PHP/React modular monolith on AWS, managed with Terraform, deployed in Docker containers, backed by MySQL in RDS. Raise the bar on this stack's security (IAM policies, VPC design, secrets management, container security, database access controls) and keep raising it as the architecture evolves.
Own and improve our security scanning program. Tune findings, cut false positives, and make sure scan results turn into developer action.
Assess and mitigate the security risks inherent in our AI products: prompt injection, data leakage, model output filtering, abuse scenarios. Set guardrails for AI-assisted development workflows so the team ships faster without opening new attack surface.
Strengthen our detection and response capabilities: logging, alerting, incident response playbooks. Coordinate penetration tests, track findings, and drive remediation.
Keep our security policies clear, current, and short. Train developers on secure practices without burying them in process.
What We're Looking For
A builder, not just an auditor. You've built or run a security program inside a product company, not just assessed one from the outside. You can point to systems, controls, and habits you put in place that made a real difference.
A technical peer to engineers. You read code, read Terraform, and talk to developers in their language. When you flag a vulnerability, you can explain the fix, not just the finding.
A pragmatist. You understand that we need to ship. You weigh tradeoffs, probability, and impact, not by saying no to everything.
A strong writer. Remote work demands it, and clear writing is clear thinking. You'll write policies, incident reports, audit narratives, and messages to engineers explaining why something matters. Clarity counts.
An AI-aware security thinker. You're already wrestling with what AI means for security: new attack surfaces, new tooling, new ways that development workflows create risk.
Experience required:
- 5+ years in application security, infrastructure security, or security engineering at a SaaS company
- Hands-on experience with AWS security (IAM, VPC, Security Groups, KMS, CloudTrail, GuardDuty)
- Experience owning or heavily contributing to the engineering side of SOC 2 Type II compliance
- Familiarity with container security (Docker, Kubernetes) and infrastructure-as-code (Terraform)
- Solid grasp of web application security fundamentals (OWASP Top 10, secure SDLC)
- Experience securing AI/ML systems or LLM-powered products
- Concrete examples of how you've used AI to improve your own security work: automating compliance tasks, speeding up threat analysis, building detection rules faster, or something we haven't thought of
- Able to work remotely from the Eastern, Central, or Mountain time zones
- Qualified to work in the United States or Canada
What We'd Be Excited to Find
- Experience building or maintaining HIPAA-compliant or HITRUST-certified environments
- CISSP, OSCP, or AWS Security Specialty certification
- Background in penetration testing or red team work
Working Conditions
- Manual dexterity required to use desktop computer and peripherals.
Compensation and Equipment
- Salary (TBD based on job experience and skill level)
- Medical insurance is covered in full for the employee (Medical, Dental, and Vision)
- Company will provide laptop and other needed computer equipment
How to Apply
Apply with a brief resume and either a written or video cover letter.
We review the cover letter before anything else in your application, so this really matters. This is your single biggest opportunity to improve your chances, and video submissions go right to the front of the line.
Prompt: How has AI changed the security landscape you work in: what's gotten easier, what's gotten harder, and how have you adapted? Tell us about a security program, control, or hard problem you're proud of owning. Tell us why this position is the one you've been hoping to find.
Written: No more than 600 words. We're looking for clarity of thought and strong communication. Use AI if you want, but don't send slop.
Video: 1–2 minutes, linked in the "Website, Blog, or Portfolio" section of your application. Doesn't need to be highly produced. We care about how you think and communicate.
We strongly encourage candidates from all backgrounds and every walk of life to apply. Every person on our team brings their own unique perspective, and it's what makes our products better and our work more rewarding. We're eager to support you so that you can ship work you're proud of.
Candidates only. No recruiters, please.
About AxisCare
According to Pew Research, roughly 10,000 baby boomers turn 65 every day, and the American Society on Aging calculated that an American has a 70% chance of needing help with activities of daily living such as dressing, bathing, hygiene, etc. This has led to an unprecedented increase in Home Care agencies in the U.S. and abroad who strive to help those who have difficulty helping themselves, specifically offering non-medical (also referred to as non-skilled) services to seniors in their homes.
AxisCare was started in 2011 by industry leaders to help meet the demand for a more user-friendly and mobile-compatible solution. Our product is a web-based management platform that helps agencies manage CRM and marketing, Caregiver/Client scheduling, billing, payroll and much more. Headquartered in Waco, TX, AxisCare has clients in all 50 states as well as 6 other countries. We are a fast-growing company seeking high-performing individuals looking for a fast-paced, autonomous working environment.
Originally posted on Himalayas
Security Engineer
Kami
About Kami
Kami is a thriving organisation filled to the brim with talented, creative, and passionate people! It’s hard not to love what you do when our leading digital classroom platform offers meaningful solutions to over 70 million users worldwide, empowering students and supporting teachers!
You’ll be joining at a pretty magical time. Kami’s user base is growing by the day. With over 170 team members across the world, we couldn’t be prouder of the accomplishments and milestones we’ve achieved to date. Now, this is your chance to join our team and become an integral member of Kami’s growth, while shaping your own future (and having fun doing it)!
The Opportunity
As a Security Engineer at Kami, you won't just be identifying risks and writing reports—you will be the one actively fixing them. We are expanding our in-house security team and need a hands-on engineer who thrives on pure engineering remediation. In this role, you will leverage our automated security tools, scanning platforms, and risk/vulnerability processes to pinpoint faults and defects across our systems and applications.
Instead of just passing off a ticket, you will jump directly into the codebase to patch those vulnerabilities, refactor out-of-life or legacy code, upgrade outdated libraries and dependencies to ensure our environment is secure and modernized. You will act as a core technical resource for the broader engineering team, writing clear security documentation and playbooks, and actively assisting and guiding developers to successfully remediate defects within their own workflows.
You will be the ultimate bridge between automated threat detection and active engineering execution, embedding robust security guardrails directly into our software development life cycle. If you are a builder who loves deep, code-level troubleshooting, enjoys replacing stale legacy infrastructure with secure code, and wants to protect a platform supporting over 50 million global users, this is the perfect place to make a massive impact.
What You’ll Do
Vulnerability & Legacy Code Remediation
- Utilize automated scanners and internal risk processes to hunt down defects. Actively dive into code bases to update outdated libraries, rewrite out-of-life legacy components, and resolve critical technical debt.
- Ensure continuous modernization of Kami’s codebase by wiping out vulnerabilities stemming from deprecated packages and old dependencies before they can be exploited.
Developer Support & Cross-Team Guidance
- Collaborate actively with engineering pods, reviewing their security posture and directly assisting them in troubleshooting and executing defect remediation.
- Accelerate internal security engineering cycles by clearing remediation blockers for engineering teams, turning security into a supportive peer function.
Security Documentation & Playbooks
- Draft comprehensive, easy-to-follow security playbooks, coding standards guidelines, and remediation documentation for internal distribution.
- Create a standardized knowledge base that upskills the entire engineering group on modern secure coding practices and streamlined defect fixing.
Secure SDLC Integration
- Embed automated security scanning tools, analysis processes, and proactive guardrails cleanly inside the active software development lifecycle.
- Ensure systematic and early-stage identification of technical faults across applications, moving toward a continuous 'shift-left' security model.
Infrastructure Hardening
- Implement and maintain robust cloud infrastructure protections, including customized firewalls, intrusion detection mechanisms, and advanced encryption protocols.
- Preserve the absolute structural integrity of our global digital infrastructure, securely partitioning and safeguarding core assets.
Incident Response Automation
- Manage and execute the emergency incident response lifecycle, building automated logic to spot, flag, and contain system anomalies instantly.
- Deliver rapid technical resolution timelines during active security incidents, significantly minimizing structural exposure or system downtime.
What You’ll Bring
- Hands-on Engineering Depth: You have 5-8+ years of experience in an Application Security or Security Engineering role. You don't just know how to run security scanners; you know how to read code, identify architectural flaws, and write the necessary fixes or scripts to resolve them.
- Dependency & Legacy Management: Proven experience managing technical debt, identifying out-of-life or legacy code paths, and safely updating third-party libraries/dependencies without breaking production features.
- Documentation & Collaboration Focus: Excellent written skills with a knack for building clean security playbooks. You enjoy working side-by-side with developers, pairing to debug technical issues, and assisting teams in pushing code fixes over the finish line.
- Modern Tooling & Environments: Familiarity with cloud-native architectures, containerized applications, CI/CD integrations, and configuring automated security testing systems (SAST/DAST/SCA).
- Proactive Problem Solving: You possess a strong builder mindset. When a security weakness is exposed, you don't just pass off a ticket—you enjoy digging into the architecture to implement lasting infrastructure or code-level safeguards.
- Application Security Fundamentals: Exposure to application security fundamentals, specifically with OWASP, is required or preferred.
- Network & Deployment: Experience with network configuration and application deployment is preferred.
Why Kami?
We’re building a high performance, best in class team to help capitalize on our exciting momentum, and continue scaling Kami's magic and making a difference to schools, students, and teachers. With Kami, you’ll have
- A people-first employer that is on an inspiring mission to build the future of education while changing the lives of millions.
- High calibre and diverse team ranging from successful startup veterans, to Fortune 500 and big tech professionals.
- Continuous learning and development opportunities, including subsidised course fees, certifications, conferences, and free access to Udemy and more.
- A strong mission; the satisfaction of knowing you’re not only helping modern-day superheroes, aka teachers but also helping them shape the minds of future generations all across the globe.
- Happy customers: Helping thousands of schools worldwide through the digital transformation of education for the 21st century. Just read our reviews.
- Huge potential: Already used by 70M users in 175 countries. One of the most popular and fastest-growing EdTech platforms worldwide.
If you’re looking for a new challenge and the opportunity to impact the lives of millions, apply now!
Originally posted on Himalayas