Staff Software Engineer - Security

Flow Engineering

San Francisco, CA

On-site

Who this role is best for

Geared toward security-focused engineers with cloud and AI experience comfortable with defining security architecture and leading incident response. The role is based in San Francisco and demands a startup-ready mindset.

Best fit for

Candidates with 8+ years of cloud security experience and a background in regulated environments
— “8+ years building production software, including running secure services at scale in the cloud.”
Individuals who have led security initiatives in regulated or high-trust environments
— “You've owned security in a regulated or high-trust environment and have implemented SOC 2 yourself.”
Engineers with hands-on knowledge of securing AI and LLM systems
— “You've secured AI or LLM systems.”

Things to consider

The role requires defining and leading security architecture from scratch in a startup environment
— “This is our first dedicated security hire, so you'll define the security architecture, harden the platform, and build out the compliance posture.”
The candidate must be prepared to work on AI and agentic workflows as a core security focus
— “Since LLMs and agentic workflows sit at the center of what we do, you'll also lead how we secure them.”

How to stand out

Emphasize experience with SOC 2 compliance and AI security in your resume and interview responses
— “Drive SOC 2 and get us ready for the certifications defense and aerospace customers ask about.”
Highlight your ability to work independently and set the security agenda in a startup setting
— “You're comfortable being the security lead at a startup and setting the agenda yourself.”
Showcase your full-stack security experience, especially in identity, network, and data protection
— “Harden the full stack, from application security to cloud infrastructure (identity, network, secrets), tenant isolation, and data protection.”

Pace · Fast PacedCollaboration · MediumAutonomy · HighDecision Impact · Company

Derived from job-description analysis by Serendipath's career intelligence engine.

What success looks like

defining and implementing security architecture
securing AI and agentic systems

Typical background

8+ years of experience in building production software with a focus on security

Skills & requirements

Required

Cloud SecurityApplication SecurityThreat ModelingIncident ResponseSecurity Compliance

Preferred

AI SecurityLLM Security

Stack & domain

Security ArchitectureApplication SecurityCloud Infrastructure SecurityData ProtectionIncident ResponseLLM And Agentic Systems SecurityLeadershipProblem-solvingCollaborationCommunicationDefenseAerospaceAi-native Requirements Platform

About the role

Original posting from Flow Engineering via Ashby

ABOUT FLOW
Flow Engineering is an AI-native requirements platform for modern engineering organizations, enabling hardware teams to collaborate with AI agents to design, validate, and evolve complex systems with speed and rigor.
ABOUT THE ROLE
Our customers in defense, aerospace and more trust us with sensitive systems requirements. That means security is a first-order part of the product, so we’re looking for a Staff Software Engineer to own it.
This is our first dedicated security hire, so you'll define the security architecture, harden the platform, and build out the compliance posture. Since LLMs and agentic workflows sit at the center of what we do, you'll also lead how we secure them.
WHAT YOU'LL DO
Own security architecture across the platform: threat modeling, secure design reviews, and the standards we build against.
Harden the full stack, from application security to cloud infrastructure (identity, network, secrets), tenant isolation, and data protection.
Drive SOC 2 and get us ready for the certifications defense and aerospace customers ask about, including export control and ITAR.
Secure our AI and agentic systems: prompt injection, data leaking through models, what actions agents are allowed to take, and guardrails.
Build the security tooling we need across detection, monitoring, vulnerability management, and CI/CD.
Stand up incident response and run it, from detection through postmortems.
Work with sales and product to get through security reviews and win customer confidence.
ABOUT YOU
8+ years building production software, including running secure services at scale in the cloud.
Deep experience in application and cloud security (AWS, GCP, or Azure): identity and access, secrets, network security, data protection.
You've owned security in a regulated or high-trust environment and have implemented SOC 2 yourself. Export control, ITAR, or FedRAMP experience is a big plus.
Solid on threat modeling, secure architecture, and incident response.
You've secured AI or LLM systems.
You're comfortable being the security lead at a startup and setting the agenda yourself.
OUR STACK (AI-LEANING)
TypeScript/Node.js and Python for AI and backend services.
Modern LLM APIs and orchestration libraries for building agentic workflows.
Postgres and other managed cloud services for data and state.
HOW WE WORK & VALUES
Speed over everything: prototype AI workflows quickly, then harden what works.
Own, downscope, ship, iterate: one clear owner per feature, from prototype to production.
Fundamentals done well: evaluation, observability, and safety are part of the first version, not an afterthought.
Competitive salary and meaningful equity.
Health, dental, and vision coverage.
Flexible time off and support for experimentation, learning, and staying current with the AI ecosystem.

Source: Flow Engineering careers (Ashby)