SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Flexport is a global commerce platform that moves over $19B in merchandise annually across 112 countries. This Senior Security Engineer role focuses on Detection & Response within the EMEA region, part of a distributed security team operating on a follow-the-sun pager rotation.
You will own detection engineering end-to-end: writing, tuning, and maintaining detections across endpoint, identity, SaaS, and cloud environments. Detections are treated as production software—version-controlled, peer-reviewed, and deployed through CI/CD pipelines. You'll track detection quality using quantified metrics including MITRE ATT&CK coverage, precision, and time-to-detect.
Incident response is a core responsibility. You'll own EMEA-hours triage, containment, remediation, and retrospectives that convert incidents into systemic fixes. You'll build automation to reduce investigation toil and partner closely with the US-based team to maintain context across time zones.
Telemetry and partnership are equally important. You'll define telemetry requirements for new systems before they ship, working with infrastructure and product teams to close visibility gaps proactively. You'll conduct threat hunting across the estate, converting hypotheses into new detections or documented coverage.
The role is distinctive because you have real authority over incident response (not a night-shift triage seat), the consequences are physical (containment decisions affect actual freight movement), and you'll inherit an established estate with genuine telemetry gaps to explore.
Flexport offers 3 days per week in the Amsterdam office with flexibility for distributed work. The company provides latest hardware and software, including frontier AI models. Visa sponsorship is available for the right candidate.
REQUIREMENTS:
- Typically 5–8 years of hands-on experience in detection engineering, incident response, or threat hunting, with proven track record writing and tuning detections in production
- Proficiency in at least one programming language (Python, Go, or similar) and ability to write production-grade detection and automation code
- Experience with a modern SIEM or detection pipeline (Panther, Elastic, Splunk, or similar), with shipped and tuned detection logic
- Practical incident response experience: led or played a major role in triaging and closing real security incidents
NICE TO HAVE:
- Experience treating detections as code with CI/CD, peer review, and staged rollout
- Experience defining telemetry contracts for systems before deployment
- Track record of critically evaluating and verifying AI-assisted work through testing, source-checking, and validation
- Familiarity with EU data-residency and cross-border data-handling considerations
- Experience with fraud or financial-crime detection patterns
