SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Flow Engineering is an AI-native requirements platform for modern engineering organizations, enabling hardware teams to collaborate with AI agents to design, validate, and evolve complex systems. The company serves customers in defense, aerospace, and related sectors who trust Flow with sensitive systems requirements, making security a first-order product concern.
You will be Flow's first dedicated security hire, owning the security architecture and compliance posture across the entire platform. This is a high-impact individual contributor role with company-wide technical scope.
Key responsibilities include:
- Define and own security architecture across the platform: conduct threat modeling, lead secure design reviews, and establish security standards.
- Harden the full technology stack, from application security to cloud infrastructure (identity, network, secrets management), tenant isolation, and data protection.
- Drive SOC 2 certification and prepare the platform for defense and aerospace certifications, including export control and ITAR compliance.
- Secure AI and agentic systems: address prompt injection risks, prevent data leaking through models, define agent action guardrails, and implement safety controls.
- Build security tooling for detection, monitoring, vulnerability management, and CI/CD integration.
- Establish and run incident response processes, from detection through postmortems.
- Partner with sales and product teams to navigate customer security reviews and build confidence.
The platform is built on TypeScript/Node.js and Python for backend services, modern LLM APIs and orchestration libraries for agentic workflows, and Postgres with managed cloud services. You'll work in a startup environment that values speed, clear ownership, and fundamentals done well—evaluation, observability, and safety are built in from the start.
REQUIREMENTS:
- 8+ years building production software, including running secure services at scale in the cloud.
- Deep experience in application and cloud security (AWS, GCP, or Azure): identity and access, secrets, network security, data protection.
- Proven track record owning security in a regulated or high-trust environment and implementing SOC 2 yourself.
- Strong expertise in threat modeling, secure architecture, and incident response.
- Experience securing AI or LLM systems.
- Comfort operating as the security lead at a startup, setting the agenda independently.
- Export control, ITAR, or FedRAMP experience is a plus.
