Senior Security Engineer, Flo

• At least 7 years of experience in the information security field
• Hands-on experience with AWS (or similar cloud platforms) and Cloudflare
• Infrastructure as Code: Proficiency with Terraform or similar IaC tools
• Vulnerability Knowledge: Solid understanding of common vulnerability classes and the OWASP Top 10
• Coding & Scripting: Proficient in reading code (e.g., Python, Scala) and using Git for version control of code and configuration changes
• Familiarity with iOS or Android security
• Experience of industry-standard SIEM and vulnerability scanning tools

Desirable

• Your role as the Security Engineer will be pivotal in supporting Flo Health’s overall security posture
• Working alongside our small but powerful Security team, you will help protect our applications and infrastructure by managing vulnerabilities, responding to incidents, and implementing security measures at scale
• You’ll also contribute to developing custom tooling and embedding security best practices into our product lifecycle to ensure we stay ahead of emerging threats
• Developing regular touchpoints with key stakeholders
• Manage Vulnerabilities: Triage newly discovered vulnerabilities, investigate potential risks, verify that fixes are effective, and drive remediation efforts across teams
• Implement Security Measures: Support teams by configuring WAF rules, setting rate limits, and deploying additional controls to protect our environment
• Develop Custom Security Tooling: Contribute to the creation and maintenance of in-house tools that enhance our security capabilities and automation
• Product Security Support: Assist in security assessments, threat modeling, and penetration testing, working closely with the Product Security team
• Secure Development Lifecycle: Help implement and improve security gates within the SDLC
• Adapt & Collaborate: Be prepared to dive into any emerging security challenges. We’re a small team with big responsibilities, and flexibility is key
• Investigate and triage security alerts, manage security incidents
• Gather, curate and communicate threat intelligence
• Support and advise business stakeholders in relation to cyber security issues
• Generate reports for both technical and non-technical staff and stakeholders