Lumos
Senior Software Engineer, Security Platform
Job Summary
The role involves leading the design and development of Lumos's Security Platform, focusing on building secure systems for identity governance, authentication, authorization, and data protection. Candidates should have experience in security engineering, backend development, and cloud platforms like AWS, with strong knowledge of security practices such as threat modeling and vulnerability remediation. The position requires collaboration across engineering, product, and platform teams to embed security into the company's infrastructure and products. Benefits include remote work, comprehensive health coverage, parental leave, and various wellness perks.
Required Skills
Benefits
Job Description
- Jump on a Rocketship: Since launching out of stealth mode just over 2 years ago, our team has grown from 20 to ~100 people and our customer base has 10x’ed with companies like GitHub, MongoDB and Major League Baseball!
- Build with Renowned Investor Backing: Andreessen Horowitz (a16z) backed us since the beginning and we've raised over $65m from Scale, Neo, Greg Brockman (President at OpenAI), Phil Venables (CISO at Google), and others.
- Thrive in a Unique Culture: You’ll join an early-stage company where you have actual influence on the trajectory of the company. We deeply care about our people and the philosophy we live by - check out our values here.
We’re looking for a Senior Software Engineer to help lead the design and development of our Security Platform—the foundation that enables secure and scalable identity governance at Lumos. In this role, you’ll build and evolve core security systems that protect customer data, enable enterprise trust, and empower product teams to move fast with confidence.
You’ll work across engineering, product, and platform teams to design secure-by-default primitives such as authentication and authorization flows, secrets management, privileged access controls, encryption systems, audit logging, and security monitoring pipelines. Your work will shape how both internal teams and enterprise customers experience security—embedded seamlessly, operating reliably, and built with care.
We’re a startup that values ownership, curiosity, and trust—and we’re looking for engineers who thrive on building foundational security systems that others build upon.
✨ Your Responsibilities
- Contribute meaningfully to the Lumos code base. Some prior projects include:
- Designing a secure proxy service for brokering customer integration credentials
- Building a SCIM server so Lumos can respond immediately to user and group updates in a customer’s Identity Provider.
- Implementing the OAuth 2.0 Device Authorization Grant flow to authenticate the Lumos CLI
- Partner with Engineering to incorporate Secure by Design principals throughout every portion of the Secure Software Development Lifecycle (SSDLC)
- Contribute to complex prioritization discussions around which risks are the most important to solve next
- Plan projects to address the risks we prioritize and coordinate with cross-functional stakeholders across the company to execute those projects
- Extend our detection and response capabilities by building solutions to identify malicious activity, triage alerts, and investigate and remediate incidents
- Identify and remediate vulnerabilities within the Lumos code base
- Assist with control enforcement and policy creation in alignment with our compliance obligations (SOC 2 Type II, ISO 27001)
- Support ongoing penetration testing programs
- Participate in security related incident response
🙌 What We Value
- 3+ years of experience as a Security Engineer or Software Engineer with a focus on Security
- Experience designing and implementing security solutions for applications and distributed systems
- For example, authentication flows and authorization frameworks, secrets management
- Strong backend development skills (Python and TypeScript knowledge is a strong plus)
- Experience with threat modeling, red teaming, penetration testing, or other means of identifying security issues
- Experience in AWS platforms and services (we will also consider equivalent experience in Azure and GCP)
- Experience securely developing and applying Infrastructure as Code solutions
- Experience at growth-stage startups is a strong plus
- Familiarity with compliance frameworks such as SOC 2 Type 2 and ISO 27001 is a plus
- Familiarity with IGA and IAM is a strong plus
- Strong product thinking and a thoughtful approach to developer experience—balancing flexibility, safety, and simplicity in platform design
- A collaborative mindset and the ability to partner across product, engineering, and design to deliver impactful platform features
💰 Pay Range
- $170,000 - $200,000 Note that this range is a good faith estimate of likely pay for this role; upon hire, the pay may differ due to skill and/or level of experience.
💸 Benefits and Perks:
- 💯 Remote work culture (+/-4 hours Pacific Time)
- ⛑ Medical, Vision, & Dental coverage covered by Lumos
- 🛩 Company and team bonding trips throughout the year fully covered by Lumos
- 💻 Optimal WFH setup to set you up for success
- 🌴 Unlimited PTO, with minimum time off to make sure you are rested and able to be at your best
- 👶🏽 Up to 16 weeks for expecting parents
- 💰 Wellness stipend to keep you awesome and healthy
- 🏦 401k matching plan
Lumos
First Autonomous Identity Platform to eliminate sprawl and identity fatigue. Discover and manage access to all apps with enhanced security, increased productivity, and reduced cost – all in one platform.
See more jobsSafe Remote Job Search Tips
Verify Employer Thoroughly
Research the company's identity thoroughly before applying. Check for a professional website with contacts, active social media, and LinkedIn profiles. Verify details across platforms and look for reviews on Glassdoor or Trustpilot to confirm legitimacy.
Never Pay to Get a Job
Legitimate employers never require payment for applications, training, background checks, or equipment. Always reject upfront payment requests or demands for bank details, even if they claim it's for purchasing necessary work gear on your behalf.
Safeguard Your Personal Information
Protect sensitive data like SSN, bank details, or ID copies. Share this only after accepting a formal, written job offer. Ensure it's submitted via a secure company system or portal, never through insecure channels like standard email attachments.
Scrutinize Communication & Interviews
Watch for communication red flags: poor grammar, generic emails (@gmail), vague details, or undue pressure. Be highly suspicious of interviews held only via text or chat apps; legitimate companies typically use video or phone calls.
Beware of Unrealistic Offers
If an offer's salary or benefits seem unrealistically high for the work involved, be cautious. Research standard pay for similar roles. Offers that appear 'too good to be true' are often scams designed to lure you into providing information or payment.
Insist on a Formal Contract
Always secure and review a formal, written job offer or employment contract before starting work or sharing final personal details. Ensure it clearly defines your role, compensation, key terms, and conditions to avoid misunderstandings or scams.