application security engineer

Flexport provides a technology-driven platform designed to simplify global trade and logistics for companies of all sizes. The organization manages the movement of goods across 112 countries, leveraging innovative solutions to optimize supply chain operations.

• Build guardrails and AI-accelerated patterns to ensure secure-by-default development;
• Maintain security tooling and automation to scale product security;
• Respond to emerging threats;
• Contribute to threat modeling, design reviews, and code reviews;
• Partner with engineering to security-review and test new features and services;
• Triage, reproduce, and validate bug bounty submissions and internal security reports;
• Prioritize vulnerabilities from SAST, secrets, and scanner findings to guide effective fixes;
• Drive remediation and track security issues through closure;
• Write clear, actionable security patterns, runbooks, and developer guidelines;
• Stay current on web and cloud security trends to inform product discussions.

• 2–5 Years of experience in product/application security or software development with a security focus;
• Strong grasp of web application security principles and common attack vectors like OWASP Top 10;
• Proficiency with application testing tools such as Burp Suite, OWASP ZAP, or browser developer tools;
• Working knowledge of at least one modern programming language (e.g., Ruby, Java/Kotlin, TypeScript/JavaScript, Python);
• Working knowledge of at least one major cloud provider (AWS, GCP, Azure);
• Hands-on experience with SAST tools like Cycode, Semgrep, or Snyk;
• Experience improving developer experience (DevEx) security;
• Clear, constructive communication skills regarding technical risk;
• Collaborative approach to partnering with developers and SREs;
• Ability to participate in security on-call rotations;
• Nice to have: Hands-on experience with bug bounty platforms, experience with cloud infrastructure security and container technologies, participation in CTF events or open-source security projects, familiarity with threat modeling frameworks and secure SDLC best practices, interest in contributing to internal developer security training programs.

• Daily catered lunches, breakfast, snacks, and soft drinks in the office;
• Commute expenses covered for employees living outside of Amsterdam;
• 25 Vacation days per year;
• Collective health insurance plan with premiums fully paid by the company;
• Defined pension contribution scheme;
• Equity program;
• Employee Assistance Program;
• Parental leave benefit.