2 months ago
Salt Lake City, UT, USASenior
Responsibilities
- Conduct security architecture and design reviews for product features and recommend risk-based mitigations.
- Help product and engineering teams prioritize application vulnerabilities by business impact.
- Serve as an application security subject matter expert for product, engineering, legal, and leadership stakeholders.
- Mentor engineers on secure development practices and build collaborative security partnerships throughout the software development lifecycle.
- Mature Lucid’s secure software development lifecycle, including coding standards, security requirements, and developer education.
- Assess and govern the security risks of AI tools and processes.
- Develop scalable security tooling and automation that integrates security controls into CI/CD pipelines.
- Lead and train engineers in Lucid’s security champions program.
Requirements
- 5+ combined years of experience in software engineering, application security, product security, or a closely related field within a SaaS environment.
- Demonstrated ability to build trusted relationships with product and engineering teams.
- Experience securing web applications built with modern frameworks and cloud-native architectures, particularly AWS.
- White-box penetration testing experience.
- Strong understanding of secure software development lifecycle principles and experience implementing or maturing secure development programs.
- Ability to conduct meaningful security architecture and design reviews focused on identifying risk early.
- Understanding of common application vulnerabilities and attack techniques, including OWASP Top 10, API security, and authentication and authorization flaws.
- Experience integrating security tooling into modern CI/CD pipelines.
- Familiarity with AI security risks and emerging attack surfaces, including agentic systems, MCP, and LLM-powered workflows.
- Strong written and verbal communication skills.
- Preferred: development experience with modern technology stacks.
- Preferred: knowledge of OWASP ASVS, NIST 800-53, SOC 2, and GDPR.
- Preferred: hands-on security certifications such as OSCP, BSCP, GWEB, PNPT, or similar.
- Preferred: bug bounty program management experience.
- Preferred: bachelor’s degree in Computer Science, Information Security, or a related field.
Benefits
- Hybrid work arrangement allowing employees to work remotely, from an office, or through a combination depending on role and team needs.
- Lucid promotes a healthy work-life balance and an inclusive, respectful workplace.
About Lucid
Lucid builds a visual collaboration suite—Lucidchart for diagramming, Lucidspark for virtual whiteboarding, and Lucidscale for cloud architecture visualization—sold as SaaS to individuals and enterprises. Founded in 2010 and headquartered in South Jordan, Utah, the privately held company integrates with Google Workspace, Microsoft 365, Atlassian, and Slack to support team planning and documentation across engineering, product, and operations.