Staff Security Engineer

Role Overview

Staff Security Engineer at Flock to establish and lead a centralized Product Security Incident Response Team (PSIRT) and run the company’s Coordinated Vulnerability Disclosure (CVD) program.

What You’ll Own

• Stand up and operate Flock’s PSIRT for externally reported and internally discovered product vulnerabilities.
• Serve as technical owner/CVE Numbering Authority (CNA): manage vulnerability intake, triage SLAs, severity rubrics, and public CVE record publishing.
• Lead cross-functional remediation with teams including Hardware, Firmware, Device SRE, Cloud SRE, Mobile, Legal, Communications, and Support to drive timely patch delivery.
• Write and publish:
  • clear public security advisories
  • internal postmortems
  • executive summaries for technical, legal, and leadership audiences
• Define PSIRT operational metrics and reporting (e.g., time-to-triage, time-to-fix, time-to-disclose).

What This Role Is Not

• Not people management (individual contributor focused on policy adherence and execution through influence).
• Not an internal SOC/corporate security role.
• Not a passive triage desk—actively guide remediation strategy and defend severity decisions with engineering leaders and external researchers.

What You Bring

• Experience running/leading PSIRT, product security, or CVD—ideally in connected hardware/IoT.
• Operational experience as a CVE Numbering Authority (CNA) and/or implementing the FIRST PSIRT Services Framework.
• Hands-on product security background across embedded/firmware security, Linux or Android device security, AWS cloud security, or mobile app security.
• Expertise applying CVSS, CWE, EPSS, and SSVC to evaluate risk and assign accurate severities.
• Strong written communication skills to translate technical vulnerabilities into advisories for customers, engineers, and executives.

Compensation

• $185,000–$230,000 starting salary (annual) + Flock stock options.
• Base salary depends on experience, education/training, and market indicators.