Staff Security Engineer

Remote (USA) Staff Security Engineer role focused on building and running PSIRT operations and owning vulnerability disclosure and CVE numbering execution.

Responsibilities

• Own the operational model and execution of Flock’s Product Security Incident Response Team (PSIRT) for every externally reported and internally discovered product vulnerability.
• Act as operational lead for CVE Numbering Authority (CNA) activities, including vulnerability intake, triage SLAs, severity rubrics, and public CVE record publishing.
• Coordinate and drive cross-functional remediation across Hardware, Firmware, Device SRE, Cloud SRE, Mobile, Legal, Communications, and Support to support timely patch delivery.
• Author accurate security documentation including public security advisories, internal postmortems, and executive summaries aligned to technical, legal, and leadership audiences.
• Establish metrics and operational reporting for PSIRT performance, tracking time-to-triage, time-to-fix, and time-to-disclose.

Requirements

• Proven experience leading or operating a PSIRT, product security function, or coordinated vulnerability disclosure program, ideally in connected hardware or IoT environments.
• Operational experience acting as a CVE Numbering Authority (CNA) or implementing the FIRST PSIRT Services Framework across discovery, triage, remediation, and disclosure.
• Hands-on background in product security for embedded or firmware security, Linux or Android device security, AWS cloud security, or mobile application security.
• Expertise applying CVSS, CWE, EPSS, and SSVC to evaluate risk and assign accurate vulnerability severities.
• Strong written communication skills, with the ability to translate complex technical vulnerabilities into clear advisories for customers, engineers, and executives.

Technologies

• FIRST PSIRT Services Framework
• CVE Numbering Authority (CNA)
• CVD (Coordinated Vulnerability Disclosure)
• CVSS
• CWE
• EPSS
• SSVC
• Linux
• Android
• AWS
• Mobile application security

Benefits

• Flock Stock Options

Role Focus Notes

• Individual contributor execution role: not a people management position; drive execution and policy adherence through cross-functional influence.
• Not an internal SOC or corporate security role; focus is on product security, field devices, and embedded software platforms.
• Not a passive triage desk: guide technical remediation strategies and support severity decisions with engineering leaders and external security researchers.

Location: Remote - USA (remote)

Salary: USD 185,000 - 230,000 per yearly