Senior Security Engineer

Title
:
Senior Security Engineer
Location
:
On‑Site;
Downtown Boston
Type
:
Full‑time exempt, 50 hours per week
Compensation
: $112.5K–$155K* + 15% bonus + Full Benefits day one

We are fiercely disrupting the concept of automobile ownership. Flexcar is on a mission to replace car ownership for the majority of car owners. We are currently operational in 4 markets and continuing to grow. Our goal is to offer a flexible alternative to car ownership that puts our members in the driver’s seat of their budget and their vehicle. Flexcar covers all maintenance costs, insurance costs, registration costs, and more, to provide the flexible ownership alternative that is simple and seamless for our members.

Flexcar empowers all walks of life to have the flexibility of a car of their own without the hassles of traditional car ownership.

Flexcar is seeking a dedicated Security Engineer as an individual contributor responsible for safeguarding a broad attack surface that includes Flexcar’s web and mobile applications, physical locations, and its remote team members. This is a highly collaborative role that will require working across all facets of the Flexcar organization.

You will be expected to champion the development and implementation of proactive defense measures across the entire organization, collaborating across multiple teams to maintain our high security standards, and educating members of the organization in the realms of general security awareness as well as best practices when it comes to delivering software.

This role requires a candidate who is a self‑starter and capable of managing multiple requests from various teams within the Flexcar organization.

• Hands‑on experience with managing a Web Application Firewall, including the creation of custom rules, rate limiting, and managing vendor rulesets.
• Must understand the current OWASP Top 10 and demonstrate the ability to educate others on how to identify and mitigate associated risks.
• Must have experience with deploying and managing defensive measures, aka “Blue Teaming”.
• Must have experience organizing and managing third‑party penetration tests and ensuring that all findings are addressed in a timely manner.
• Hands‑on experience with threat modeling.
• Experience leading tabletop sessions with members of the engineering team as well as non‑technical members of the organization.
• Demonstrated ability to conduct Open‑Source Intelligence (OSINT) against the organization and its resources.
• Demonstrated ability to conduct internal offensive security campaigns against Flexcar’s web application and the organization itself.

• Experience creating CI/CD workflows and utilizing open‑source security tools.
• Experience with static analysis tools for code, dependencies, and container images.
• Familiarity with AWS security tools and resources.
• Familiarity with Terraform.
• Experience with hardening Microsoft Entra (Azure AD) and O365.
• Proven experience with Identity and Access Management.
• Experience with administration of common Managed Detection and Response (MDR) solutions.
• Hands‑on experience with scripting languages like Python.

• Proven ability to serve as a Security Incident Commander.
• Ability to use the tools available for leading forensic analyses and guiding investigative efforts.
• Demonstrated ability to conduct threat hunting based on new threats as they are discovered or disclosed by the larger security community.

• Familiarity with maintaining compliance with frameworks such as PCI, CCPA, and US Data Privacy.
• Familiarity with compliance automation platforms.
• Experience creating and maintaining foundational security policies.
• Ability to manage Flexcar’s third‑party vendor assessment process.
• Ability to create both general security awareness content for the organization as well as targeted training for a variety of individual teams.

• Rest & Relax! Flexible Paid Time Off and Sick Time
• Save for Your Future! 401(k) with company match from day one of hire
• Benefits: Excellent, low‑cost healthcare coverage including medical, dental, vision,…