Senior Security Engineer
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
Senior Security Engineer building security foundations for Lumos’s autonomous identity platform. Designing authorization, threat modeling, cloud security, and vulnerability response for enterprise customers.
Responsibilities:
- Design and ship core security platform systems in the Lumos codebase, including request context propagation, scoped API tokens, authorization services, and decoupled authentication from synced identities.
- Lead multi-sprint security projects end to end and coordinate with engineers across teams.
- Run security architecture reviews and threat models for new products, including the MCP Governance gateway and on-device policy checks.
- Turn security findings into tracked, prioritized work.
- Drive least-privilege access to production systems, databases, data pipelines, AWS IAM, and secrets.
- Triage, route, and fix vulnerabilities from penetration tests, cloud assessments, and dependency scanning; coordinate retests.
- Participate in security on-call and incident response.
- Answer security questions from customers and prospects.
- Build security foundations for Lumos's identity platform and advise customers on security.
Requirements:
- 5+ years of software engineering experience, with at least 3 focused on security (application, product, or platform security).
- Track record of designing, shipping, and operating production security systems, including authentication and authorization frameworks, token and session management, secrets management, or audit logging.
- Strong backend skills.
- Python and TypeScript are a strong plus; Go is welcome.
- Clear written communication.
- Hands-on experience with threat modeling, secure design review, and finding and fixing vulnerabilities in a real codebase.
- Experience securing cloud infrastructure on AWS, including IAM and Infrastructure as Code; equivalent GCP or Azure experience considered.
- Nice to have: OAuth 2.0, OIDC, SAML, SCIM, OPA, Zanzibar-style models, Cedar, SOC 2, ISO 27001, IAM, and/or growth-stage startup experience.
- Must be eligible to work in the United States or Canada; application asks whether sponsorship is required to work in Canada or the United States.
Benefits:
- Remote-first culture – Work from anywhere within ±4 hours of Pacific Time.
- Medical, dental & vision insurance – 100% of premiums covered for employees, 60% for dependents. HSA and FSA available with employer contribution. International benefits align with local standards.
- Mental health support – Access to mental health resources and support.
- Monthly wellness stipend – A monthly stipend for gym memberships, fitness apps, and whatever helps you recharge.
- Life & disability insurance – Life insurance, short-term disability, and long-term disability coverage available.
- Flexible PTO – Flexible time off with a minimum annual requirement.
- Parental leave – Up to 16 weeks of paid parental leave for expecting parents.
- $1,000 annual learning stipend – An annual budget for courses, books, conferences, and certifications.
- Company & team offsites – Company and team bonding trips throughout the year, fully covered by Lumos.
- 401(k) with matching – Employer 401(k) matching.
Similar Jobs
Security Engineer II
Security Engineer securing information systems, data, and networks for a global organization. Conducting risk assessments, audits, incident investigations, and cybersecurity tool administration.
Senior Profesional Seguridad Física
Senior Physical Security Professional leading risk, security strategy, contracts, and public-force partnerships. PAR Servicios Integrales manages supplier services for the energy sector.
Senior Manager, Pre-Close Security
Senior cybersecurity deal lead assessing risks across Johnson & Johnson acquisitions, divestitures, and strategic transactions. Translating technical diligence into closing, Day 1, and post-close security decisions.
Senior Manager, Pre-Close Security
Senior cybersecurity deal lead guiding pre-close diligence for Johnson & Johnson healthcare transactions. Assessing cyber risks, advising deal decisions, and preparing Day 1 security handoffs.
Senior Security Engineer
Senior Security Engineer building Python-based automation, integrations, and AI/LLM workflows. Improving SOC operations for a software development client.
IT Cybersecurity Compliance Technical Associate – Campus 2027
Cybersecurity compliance associate supporting GRC workflows, risk assessments, control reviews, and audits at Guidehouse. Assisting U.S. business-hour escalations and compliance documentation.
Senior IT Security Engineer – Security Architecture, Operations
Senior IT Security Engineer developing security architecture and operations for Hypoport’s network of technology companies. Leading monitoring, incident response, tooling and automation.
Adjunct – IT/Cybersecurity
Adjunct instructor teaching IT and cybersecurity courses at Lackawanna College, a private Pennsylvania institution. Preparing course materials, supporting students, and reporting grades.
Cybersecurity Ops Analyst
Cybersecurity Ops Analyst monitoring and investigating threats for SAIC, a defense and mission technology integrator. Operating SIEM and EDR tools across a 24/7/365 security operations center.
Cybersecurity Operations Supervisor, 3rd Shift
Cybersecurity Operations Supervisor leading SAIC’s 24/7 enterprise security response team. Managing investigations, analysts, staffing, and continuous SOC improvements on third shift.
Security Architect
Security Architect designing and assuring secure systems for NEC Software Solutions. Supporting critical public-sector services through threat modelling, governance, and security architecture.
Senior Counsel – Data Governance, Privacy, Cybersecurity
Senior Counsel guiding Cencora’s healthcare services organization on data privacy, cybersecurity, AI, and governance. Advising on regulated health data, contracts, incident response, and technology-enabled offerings.
Adjunct Faculty, Cybersecurity for Leaders and Managers
Cybersecurity adjunct faculty teaching CSIA 300 asynchronously for University of Maryland Global Campus. Mentoring adult learners and supporting their academic and professional growth.
Adjunct Faculty – Microsoft 365 Endpoint Administration, Cybersecurity
Adjunct faculty teaching Microsoft 365 Endpoint Administration at UMGC, an online university serving nontraditional learners. Mentoring students through asynchronous, hands-on cybersecurity coursework.
Security Advisor II, Falcon Complete
Security Advisor guiding CrowdStrike Falcon Complete customers toward stronger security postures. Assessing Falcon environments, recommending remediation, and resolving customer issues.
Senior Director – Security Posture & Exposure Management
Senior security leader overseeing Lilly’s enterprise vulnerability management and exposure reduction. Leading teams, tooling, prioritization, remediation, and executive risk reporting for a global medicines company.
Infrastructure Security Vulnerability Engineer
Infrastructure Security Vulnerability Engineer reducing vulnerability risk across Avaya’s FedRAMP cloud environments. Coordinating remediation, compliance, reporting, and security improvements for federal-government operations.
Cybersecurity Specialist
Cybersecurity Specialist monitoring alerts and investigating incidents for CyberMaxx’s managed detection and response cybersecurity services. Supporting threat detection, customer response, and SOC operations.
Senior Information Security Engineer
Information Security Engineer monitoring threats and vulnerabilities for First American's title insurance, settlement, and property technology solutions. Operating security tools, incident response, risk analysis, and recovery processes.
Senior Information Security Engineer
Senior Cloud Security Engineer operating CNAPP platforms and securing cloud environments at First American India. Driving cloud risk remediation across infrastructure, applications, Kubernetes, and DevSecOps teams.