Senior Security Engineer
A sole senior security engineer owns Luxer One's entire security program end to end: cloud security on AWS/GCP, security operations and incident response, product security (threat modeling, secure SDLC), compliance certifications, and emerging AI/LLM agent security for their smart locker IoT platform. On-site or hybrid in Sacramento, CA.
- Compensation
- $145K–$180K / yr
- Location
- Mcclellan, United States
- Work setup
- Hybrid
- Seniority
- Senior
- Employment
- Not specified
- Experience
- Not specified
- Category
- Security
- Posted
Skills
Must have
- Eight or more years of security experience with ownership across both IT and product security
- Founding or first security hire experience (or equivalent) at a startup or growth-stage company
- Hands-on security operations depth: SIEM, IR execution, vulnerability management, real incident ownership
- Product security experience: threat modeling, pen test coordination, secure SDLC enforcement
- AI or LLM security experience: securing model access, auditing agent actions, building guardrails for autonomous systems
- End-to-end compliance program ownership: ISO 27001, SOC 2, or equivalent
- Familiarity with AI governance frameworks: NIST AI RMF, ISO 42001, or emerging regulatory requirements
- Cloud security depth: AWS or GCP, CSPM, IAM, cloud incident response
- Strong written and verbal communication: policy, post-mortems, executive briefings, customer-facing conversations
Nice to have
- Experience securing IoT, connected hardware, or firmware-based products
- Hands-on agentic AI security experience: MCP, tool-use APIs, multi-agent systems, autonomous agent monitoring
- Privacy engineering depth: CCPA/CPRA operational compliance, DSAR handling, consent management
- Relevant certifications: CISSP, GIAC (GCIH, GPEN, GCIA), CIPP/US or CIPP/E, ISO 27001 Lead Implementer, AIGP, or ISO 42001 Lead Implementer
- Experience with Wiz, Datadog Security, CrowdStrike, or similar modern security tooling
Full description
SENIOR SECURITY ENGINEER
Own the security program — from cloud infrastructure to AI agents — at a hardware-meets-software IoT company moving fast.
About Luxer One
Luxer One builds and deploys smart locker and access systems across multifamily, commercial, retail, and enterprise markets in North America. An Assa Abloy company, our platform spans cloud infrastructure, mobile applications, IoT firmware, and a live AI operating system — Cortex — with more than twenty deployed autonomous AI agents running real operations across the company. We process millions of transactions annually and are trusted by enterprise customers who take security seriously.
We are not a software company that ships firmware on the side. We are not a hardware company trying to do software. We are both, fully, which makes the security surface broader and more interesting than most.
Why This Role Exists
We have built a lot. Cloud infrastructure running on AWS and GCP. Mobile apps. Embedded firmware on connected locker hardware deployed at thousands of sites. A growing AI operating system with autonomous agents that take real actions against real data. Enterprise customers with real compliance requirements — CCPA, CPRA, ISO 27001 — and a pipeline expanding into Canada and Europe.
What we need is one senior security engineer who owns the whole picture: designs the programs, runs the tools, executes incident response, and is the security authority for our AI systems. Not a team. Not a security analyst to hand off to. You.
If you have been the first or founding security hire somewhere before — or you are ready to be — this is a high-ownership, high-impact seat at a company that is genuinely ahead of most on AI adoption and needs someone who can help keep it that way.
Who You Are
You are a security practitioner who builds programs and runs them. The distinction between "architect" and "operator" is not interesting to you — you do both because both need to get done. You are hands-on with tooling, direct in incident response, and thoughtful in design reviews. You treat engineering teams as partners, not compliance risks to manage.
You are also someone who has thought seriously about AI security — not because it is a trend, but because you understand that LLM-based systems and autonomous agents introduce attack surfaces that traditional security tooling does not cover, and you want to be the person who figures that out in a production environment.
You are probably at a startup or growth-stage company right now — or you have been recently. You have had to make the program work with limited resources, build what did not exist, and be the person engineering leadership calls when something goes wrong. That is the profile.