Senior Security Engineer

Why Lumos?

💸 Benefits and Perks

• 💻 Remote-first culture – Work from anywhere within ±4 hours of Pacific Time.
• 🏥 Medical, dental & vision insurance – 100% of premiums covered for employees, 60% for dependents. HSA and FSA available with employer contribution. International benefits align with local standards.
• 🧠 Mental health support – Access to mental health resources and support.
• 💪 Monthly wellness stipend – A monthly stipend for gym memberships, fitness apps, and whatever helps you recharge.
• 🛡️ Life & disability insurance – Life insurance, short-term disability, and long-term disability coverage available.
• 🌴 Flexible PTO – Flexible time off with a minimum annual requirement, because rest is part of doing your best work.
• 👶 Parental leave – Up to 16 weeks of paid parental leave for expecting parents.
• 📚 $1,000 annual learning stipend – An annual budget for courses, books, conferences, and certifications.
• ✈️ Company & team offsites – Company and team bonding trips throughout the year, fully covered by Lumos.
• 💰 401(k) with matching – Employer 401(k) matching to help you save for the future.

Requirements

• 5+ years of software engineering experience, with at least 3 focused on security (application, product, or platform security).
• A track record of designing, shipping, and operating production security systems, not only reviewing them. Examples: authentication and authorization frameworks, token and session management, secrets management, audit logging.
• Strong backend skills. Python and TypeScript are a strong plus. Go is welcome.
• Clear written communication. You can explain a risk and a trade-off to engineers, PMs, and customers alike.
• Nice to have: identity protocols (OAuth 2.0, OIDC, SAML, SCIM), policy engines (OPA, Zanzibar-style models, Cedar), SOC 2 or ISO 27001 environments, general background in IAM, and/or growth-stage startup experience. Hands-on experience with threat modeling, secure design review, and finding and fixing vulnerabilities in a real codebase. Experience securing cloud infrastructure on AWS (equivalent GCP or Azure experience considered), including IAM and Infrastructure as Code.