Senior Security Engineer

Luxer One•Mcclellan, CA

39d•$145,000 - $180,000•Hybrid

About The Position

This role is for a Senior Security Engineer at a hardware-meets-software IoT company. The engineer will own the security program, covering cloud infrastructure, AI agents, mobile applications, and embedded firmware. The company operates in North America and is expanding into Canada and Europe, processing millions of transactions annually and serving enterprise customers with compliance requirements like CCPA, CPRA, and ISO 27001. The position requires a hands-on approach to designing programs, running tools, executing incident response, and serving as the security authority for AI systems. It is a high-ownership, high-impact role for someone ready to be a founding or first security hire.

Requirements

Eight or more years of security experience with clear ownership across both IT and product security in the same role.
Demonstrated experience as a founding or first security hire — or the functional equivalent — at a startup or growth-stage company.
Hands-on security operations depth: SIEM, IR execution, vulnerability management, real incident ownership.
Product security experience: threat modeling, pen test coordination, secure SDLC enforcement alongside engineering teams.
AI or LLM security experience — securing model access, auditing agent actions, building guardrails for autonomous systems, or applying AI governance frameworks to production deployments.
End-to-end compliance program ownership: ISO 27001, SOC 2, or equivalent — not just participation, full ownership.
Familiarity with AI governance frameworks: NIST AI RMF, ISO 42001, or emerging regulatory requirements.
Cloud security depth — AWS or GCP, CSPM, IAM, cloud incident response.
Strong written and verbal communication — policy, post-mortems, executive briefings, customer-facing security conversations.

Nice To Haves

Experience securing IoT, connected hardware, or firmware-based products.
Hands-on agentic AI security experience — MCP, tool-use APIs, multi-agent systems, autonomous agent monitoring.
Privacy engineering depth — CCPA/CPRA operational compliance, DSAR handling, consent management.
Relevant certifications: CISSP, GIAC (GCIH, GPEN, GCIA), CIPP/US or CIPP/E, ISO 27001 Lead Implementer, AIGP, or ISO 42001 Lead Implementer.
Experience with Wiz, Datadog Security, CrowdStrike, or similar modern security tooling.

Responsibilities

Design and own the security program across cloud infrastructure, AI agents, mobile applications, and IoT firmware.
Implement and manage security tools.
Execute incident response.
Serve as the security authority for AI systems.
Produce controls libraries, compliance evidence, playbooks, and threat models.
Tune SIEM, triage alerts, execute incident response, and manage vulnerability remediation.
Perform threat modeling alongside engineering teams, coordinate penetration tests, and enforce secure SDLC in CI/CD pipelines.
Secure AI/LLM systems, including prompt injection, tool abuse, agent identity, and runtime monitoring for autonomous systems.
Design guardrails for AI systems and detect when they fail.
Take ownership of security issues, including responding to incidents at any time.
Write post-mortems.
Run compliance programs to certification.
Handle customer-facing security conversations.