2 months ago
Raleigh, NC, USASenior
Responsibilities
- Conduct security architecture and product design reviews and recommend practical risk mitigations.
- Apply a risk-based approach to prioritize application vulnerabilities by business impact.
- Serve as an application security subject matter expert for product, engineering, legal, and leadership stakeholders.
- Mentor engineers on secure development practices and lead the security champions program.
- Partner with product and engineering teams throughout the software development lifecycle as their primary security resource.
- Mature the SSDLC through secure coding standards, security requirements, and developer security education.
- Ensure AI tools and processes remain within acceptable risk limits.
- Develop and maintain security tooling and automation that integrates controls into CI/CD pipelines.
- Conduct white-box penetration testing and help secure web applications and cloud-native architectures.
Requirements
- At least 5 years of combined experience in software engineering, application security, product security, or a closely related field within a SaaS environment.
- Experience building trusted relationships with product and engineering teams.
- Experience securing web applications built with modern frameworks and cloud-native architectures, particularly AWS.
- Experience with white-box penetration testing.
- Strong understanding of SSDLC principles and experience implementing or maturing secure development programs.
- Ability to conduct security architecture and design reviews focused on identifying risk early.
- Knowledge of common application vulnerabilities and attack techniques, including OWASP Top 10, API security, and authentication and authorization flaws.
- Experience integrating security tooling into CI/CD pipelines.
- Ability to communicate security risk in business terms and support pragmatic decisions.
- Familiarity with AI security risks and emerging attack surfaces, including agentic systems, MCP, and LLM-powered workflows.
- Strong written and verbal communication skills.
- Preferred: development experience with modern technology stacks.
- Preferred: knowledge of OWASP ASVS, NIST 800-53, SOC 2, GDPR, or similar security and compliance frameworks.
- Preferred: OSCP, BSCP, GWEB, PNPT, or similar hands-on security certification.
- Preferred: bug bounty program management experience.
- Preferred: bachelor’s degree in Computer Science, Information Security, or a related field.
Benefits
- Lucid offers a hybrid workplace with remote work, office work, or a combination depending on the role and team.
- The company emphasizes work-life balance and an inclusive, respectful workplace culture.
About Lucid
Lucid builds a visual collaboration suite—Lucidchart for diagramming, Lucidspark for virtual whiteboarding, and Lucidscale for cloud architecture visualization—sold as SaaS to individuals and enterprises. Founded in 2010 and headquartered in South Jordan, Utah, the privately held company integrates with Google Workspace, Microsoft 365, Atlassian, and Slack to support team planning and documentation across engineering, product, and operations.