Senior Security Engineer

Luxer One•Mcclellan, CA

37d•Hybrid

About The Position

Luxer One is seeking a Senior Security Engineer to own their security program across cloud infrastructure, mobile applications, IoT firmware, and an AI operating system. This role is crucial for a hardware-meets-software IoT company that processes millions of transactions annually and serves enterprise customers with stringent security and compliance requirements (CCPA, CPRA, ISO 27001). The ideal candidate will be a hands-on practitioner who can design programs, manage tools, execute incident response, and act as the security authority for AI systems. This is a high-ownership, high-impact position for someone ready to be the first or founding security hire, or who has effectively functioned as one, at a company at the forefront of AI adoption.

Requirements

Eight or more years of security experience with clear ownership across both IT and product security in the same role.
Demonstrated experience as a founding or first security hire — or the functional equivalent — at a startup or growth-stage company.
Hands-on security operations depth: SIEM, IR execution, vulnerability management, real incident ownership.
Product security experience: threat modeling, pen test coordination, secure SDLC enforcement alongside engineering teams.
AI or LLM security experience — securing model access, auditing agent actions, building guardrails for autonomous systems, or applying AI governance frameworks to production deployments.
End-to-end compliance program ownership: ISO 27001, SOC 2, or equivalent — not just participation, full ownership.
Familiarity with AI governance frameworks: NIST AI RMF, ISO 42001, or emerging regulatory requirements.
Cloud security depth — AWS or GCP, CSPM, IAM, cloud incident response.
Strong written and verbal communication — policy, post-mortems, executive briefings, customer-facing security conversations.

Nice To Haves

Experience securing IoT, connected hardware, or firmware-based products.
Hands-on agentic AI security experience — MCP, tool-use APIs, multi-agent systems, autonomous agent monitoring.
Privacy engineering depth — CCPA/CPRA operational compliance, DSAR handling, consent management.
Relevant certifications: CISSP, GIAC (GCIH, GPEN, GCIA), CIPP/US or CIPP/E, ISO 27001 Lead Implementer, AIGP, or ISO 42001 Lead Implementer.
Experience with Wiz, Datadog Security, CrowdStrike, or similar modern security tooling.

Responsibilities

Own the entire security program, from cloud infrastructure to AI agents.
Design security programs and run the necessary tools.
Execute incident response.
Act as the security authority for AI systems.
Build security controls libraries, compliance evidence, playbooks, and threat models.
Tune SIEM, triage alerts, execute incident response, and manage vulnerability remediation with patching accountability.
Perform threat modeling alongside engineering teams, coordinate penetration tests, and enforce secure SDLC in CI/CD pipelines.
Secure AI/LLM systems, including prompt injection, tool abuse, agent identity, and runtime monitoring for autonomous systems.
Design guardrails for AI systems and detect when they fail.
Take ownership of security incidents, including late-night calls.
Write post-mortems for security incidents.
Operate security programs in lean environments with limited resources.
Build security solutions where they do not exist.
Serve as the primary security contact for engineering leadership.
Own end-to-end compliance programs, such as ISO 27001 or SOC 2.
Communicate security policies, post-mortems, and executive briefings.
Engage in customer-facing security conversations.