Senior Software Engineer, Security

The posting, as Flex wrote it

Flex is building AI-native financial services for business owners.

We’re re-architecting the entire financial system for entrepreneurs—from the first dollar a business earns to how that value compounds, moves, and is ultimately spent in real life. Banking, credit, payments, personal finance, and financial operations—rebuilt from the ground up as a single, intelligent system. Flex is the full financial home for ambitious owners.

Since launching publicly in September 2023, Flex has scaled from zero to nine-figure annualized revenue, with a clear path to profitability by late 2026. We move fast, ship relentlessly, and operate with extreme ownership.

Our customers are affluent business owners ($3–$200M in revenue)—the backbone of the economy and one of the most underserved segments in finance. They’re stuck with outdated banks and fragmented tools. We’re replacing all of it. The opportunity is massive: a ~$1T+ revenue market hiding in plain sight. Our ambition is to build a $100B+ company by delivering a product that is fundamentally better—not incrementally improved.

Flex has raised $100M+ in equity and $300M+ in debt.

• Mission-critical problems: We build software that directly controls how money moves at scale.
• High bar, low ego: Small teams, exceptional people, real ownership.
• Speed over comfort: We prioritize execution, quality, clarity, and results.
• Enduring impact: What we’re building will define how a generation of owners runs their businesses.

Team & Locations

We hire exceptional people who want to build hard things and see their work matter immediately. Roles are available in: San Francisco, Miami, New York, and fully remote.

Flex Fuels Ambition.

About the Role
We're hiring our first security engineers. Both report directly to the CTO.
We want software engineers with security as their superpower, not security specialists who occasionally write code. The distinction matters here. At our size, the only way one person covers a surface this large is to build things that keep working after they move on. A findings queue you work through by hand grows faster than you can close it. A guardrail in the deployment pipeline doesn't.
The work is product and infrastructure security: making the paths that move money hard to attack, and making the secure way to build something also the easy way. The ledger and its write path, card issuing, payouts, and our stablecoin work are the systems that matter most. The job runs in both directions. You'll be in design review early on anything new, and you'll be continuously assessing what we've already shipped, because most of Flex's risk lives in code that exists today. We don't expect you to read the codebase by hand or to keep a findings queue. We expect you to build the automation and repeatable checks that keep assessing it for you, and to spend the time you get back on the golden paths that stop whole classes of problem from arriving again.
There's no security team above you and no
[…]
ething isn't worth fixing right now.
You know you won't personally touch every security problem here, and you don't want to. You build the defaults and the habits that let engineers make good security decisions without you in the room.
You can read a system diagram and find the trust boundary nobody drew.
You write clearly. Much of this job is convincing people in writing, across time zones.
What We're Looking For
Substantial hands-on experience building or securing systems in a fast-moving environment, including a stretch where you were the most senior person doing this work. We care about what you've built, not the year count.
Real software engineering ability in a language we'd ship (Python, Go, TypeScript, or similar). Not scripting alone.
Hands-on cloud infrastructure experience: AWS or GCP, Terraform or equivalent IaC, containers, and CI/CD pipelines you've changed, not only used.
Practical threat modeling on systems with real consequences, and the judgment to know which findings matter.
Experience with secrets management, workload identity, and service-to-service authorization.
Experience handling inbound vulnerability reports, including at least one difficult reporter.
Clear written communication and a bias toward writing things down.
Strongly Preferred
A platform, infrastructure, or DevOps background where you moved toward security by choice. A great infrastructure engineer who wants to do this work will beat a traditional security hire who wants to write policy, every time.
Experience at a small company, or as a founder, where you were the only person who could do this and had to decide what to skip.
Experience running a VDP or bug bounty program, including the triage.
Fintech, payments, or another regulated environment, on the building side.
Experience applying AI or LLM tooling to security work in a way that held up in production.
Certifications like OSCP or OSWE are a signal we'll happily read, but they don't substitute for an engineering track record.