This position is no longer accepting applications
Closed on September 10, 2026.
This role is filled — get an email when new Information Security roles open on EngineerJobs.io:
Staff Security Engineer
Application Security
Cloud Security
Cve Management
Incident Response
Information Security
InfoSec
Product Security
Psirt
Security
Security Operations
Vulnerability Management
View similar jobs
Get alerted when similar jobs are posted — set up a New Information Security jobs on EngineerJobs.io alert.
See other roles at Flock Safety.
Job Description
Remote (USA) Staff Security Engineer role focused on building and running PSIRT operations and owning vulnerability disclosure and CVE numbering execution.
Responsibilities
- Own the operational model and execution of Flock’s Product Security Incident Response Team (PSIRT) for every externally reported and internally discovered product vulnerability.
- Act as operational lead for CVE Numbering Authority (CNA) activities, including vulnerability intake, triage SLAs, severity rubrics, and public CVE record publishing.
- Coordinate and drive cross-functional remediation across Hardware, Firmware, Device SRE, Cloud SRE, Mobile, Legal, Communications, and Support to support timely patch delivery.
- Author accurate security documentation including public security advisories, internal postmortems, and executive summaries aligned to technical, legal, and leadership audiences.
- Establish metrics and operational reporting for PSIRT performance, tracking time-to-triage, time-to-fix, and time-to-disclose.
Requirements
- Proven experience leading or operating a PSIRT, product security function, or coordinated vulnerability disclosure program, ideally in connected hardware or IoT environments.
- Operational experience acting as a CVE Numbering Authority (CNA) or implementing the FIRST PSIRT Services Framework across discovery, triage, remediation, and disclosure.
- Hands-on background in product security for embedded or firmware security, Linux or Android device security, AWS cloud security, or mobile application security.
- Expertise applying CVSS, CWE, EPSS, and SSVC to evaluate risk and assign accurate vulnerability severities.
- Strong written communication skills, with the ability to translate complex technical vulnerabilities into clear advisories for customers, engineers, and executives.
Technologies
- FIRST PSIRT Services Framework
- CVE Numbering Authority (CNA)
- CVD (Coordinated Vulnerability Disclosure)
- CVSS
- CWE
- EPSS
- SSVC
- Linux
- Android
- AWS
- Mobile application security
Benefits
- Flock Stock Options
Role Focus Notes
- Individual contributor execution role: not a people management position; drive execution and policy adherence through cross-functional influence.
- Not an internal SOC or corporate security role; focus is on product security, field devices, and embedded software platforms.
- Not a passive triage desk: guide technical remediation strategies and support severity decisions with engineering leaders and external security researchers.
Location: Remote - USA (remote)
Salary: USD 185,000 - 230,000 per yearly
Similar Jobs
