Cloud Infrastructure Security Engineer

About Flexport: 

At Flexport, we believe global trade can move the human race forward. That’s why it’s our mission to make global commerce so easy there will be more of it. We’re shaping the future of a $10T industry with solutions powered by innovative technology and exceptional people. Today, companies of all sizes—from emerging brands to Fortune 500s—use Flexport technology to move more than $19B of merchandise across 112 countries a year. 

The recent global supply chain crisis has put Flexport center stage as we continue to play a pivotal role in how goods move around the world. We are proud to have the support of the best investors in the game who believe in our mission, solutions and people. Ready to tackle global challenges that impact business, society, and the environment? Come join us.

All security disciplines work under the umbrella of the combined PSI (Platform, Security & Infrastructure) team: we build the paved path and tooling that hundreds of engineers around the world rely on every day to ship. This is not a compliance or certification role. You won't be measured on audit portfolios. You'll be measured on the guardrails you build and whether engineering teams reach for them by default.

A misconfigured IAM boundary here doesn't just degrade a dashboard: it can stall a customs filing or strand a container. Flexport also runs a genuinely heterogeneous estate: hundreds of services, carrier and customs integrations, and infrastructure spanning three continents, which makes multi-account architecture and cross-border data handling real problems rather than exam questions.

What You'll Do

Architecture & guardrails

• Design and review cloud security architecture for AWS and Kubernetes: account structure, network segmentation, workload identity, and secure-by-default patterns for new services.
• Fix the Terraform module, not the finding — drive remediation-at-source so misconfigurations get closed at the pattern level, not one ticket at a time.

Kubernetes & workload security

• Harden our Kubernetes platform: pod security, service mesh and network policy, secrets management, and supply-chain controls (image provenance and signing).
• Partner with platform engineers so new services inherit secure defaults instead of requesting them after the fact.

Policy & automation

• Build and maintain policy-as-code and IaC scanning that block risky patterns in CI.
• Write real code — Go or Python, shipped through the same CI/CD the rest of engineering uses.