Sr. Security Engineer

Responsibilities

• Conduct thorough security architecture and design reviews for new and evolving product features, surfacing risk early and recommending practical mitigations.
• Drive a risk-based approach to application security, helping teams understand and prioritize vulnerabilities by business impact.
• Serve as a subject matter expert on application security topics for product, engineering, legal, and leadership stakeholders.
• Mentor engineers across the organization on secure development practices, fostering a culture where security is everyone's responsibility.
• Build and maintain strong, collaborative partnerships with product and engineering teams, serving as their primary security resource and advocate throughout the software development lifecycle.
• Mature Lucid's Secure Software Development Lifecycle (SSDLC), including secure coding standards, security requirements, and developer security education.
• Ensure AI tools and processes are implemented within acceptable risk limits.
• Lead product design reviews to ensure security considerations are inherent in feature design.
• Develop and maintain scalable security tooling and automation to integrate security controls into CI/CD pipelines with a focus on reducing risk over implementing tools.
• Lead and train engineers in Lucid's security champions program.

Requirements

• 5+ combined years of experience in software engineering, application security, product security, or a closely related field within a SaaS environment.
• Proven track record of building trusted, effective relationships with product and engineering teams.
• Experience securing web applications built on modern frameworks and cloud-native architectures (particularly AWS).
• White-box penetration testing experience.
• Strong understanding of SSDLC principles and experience implementing or maturing secure development programs.
• Ability to conduct meaningful security architecture and design reviews, with a focus on identifying risk early in the development process.
• Solid understanding of common application vulnerabilities and attack techniques (OWASP Top 10, API security, authentication/authorization flaws, etc.).
• Experience integrating security tooling into modern CI/CD pipelines.
• Risk-focused mindset: able to articulate security risk in business terms and help teams make informed, pragmatic decisions while avoiding security theater.
• Familiarity with AI security risks and emerging attack surfaces, including securing agentic systems, MCP, and LLM-powered workflows against new and evolving threats.
• Strong written and verbal communication skills; equally comfortable in a design review with engineers and a risk conversation with leadership.

Preferred Qualifications

• Development experience in modern tech stacks.
• Practical knowledge of relevant security frameworks and compliance standards (e.g., OWASP ASVS, NIST 800-53, SOC 2, GDPR).
• Relevant certifications such as OSCP, BSCP, GWEB, PNPT, or similar hands-on security-focused certifications.
• Experience with bug bounty program management.
• Bachelor's degree in Computer Science, Information Security, or a related field.

#LI-DA1