The ad says“Mobile security (iOS, Android) and API security”
The ad says“Technical Depth: Demonstrated expertise across core product and application security domains, including:”
The ad says“Cloud security fundamentals (AWS, GCP) and container/infrastructure security”
The ad says“Secure development practices and SDLC security integration (SAST, DAST, SCA, secrets management)”
The ad says“Experience with detection engineering, security monitoring, or building detection-as-code (DaC) pipelines for product or application security threats (SIEM, log analysis, alert tuning)”
The ad says“Cloud security fundamentals (AWS, GCP) and container/infrastructure security”
The ad says“Familiarity with IoT, connected hardware, or vehicle/firmware security in a product security context”
The ad says“Mobile security (iOS, Android) and API security”
The ad says“Authentication and authorization patterns (OAuth, OIDC, RBAC)”
The ad says“Authentication and authorization patterns (OAuth, OIDC, RBAC)”
The ad says“Authentication and authorization patterns (OAuth, OIDC, RBAC)”
The ad says“Secure development practices and SDLC security integration (SAST, DAST, SCA, secrets management)”
The ad says“Secure development practices and SDLC security integration (SAST, DAST, SCA, secrets management)”
The ad says“Secure development practices and SDLC security integration (SAST, DAST, SCA, secrets management)”
The ad says“Technical Depth: Demonstrated expertise across core product and application security domains, including:”
The ad says“Experience with detection engineering, security monitoring, or building detection-as-code (DaC) pipelines for product or application security threats (SIEM, log analysis, alert tuning)”
The ad says“Technical Depth: Demonstrated expertise across core product and application security domains, including:”
The ad says“Technical Depth: Demonstrated expertise across core product and application security domains, including:”
Values
The ad says“Education & Certifications: Bachelor’s degree in Computer Science, Cybersecurity, or a related field preferred but not required. Relevant certifications such as OSCP, CSSLP, GWEB, or equivalent are a plus”
The ad says“Education & Certifications: Bachelor’s degree in Computer Science, Cybersecurity, or a related field preferred but not required. Relevant certifications such as OSCP, CSSLP, GWEB, or equivalent are a plus”
The ad says“Education & Certifications: Bachelor’s degree in Computer Science, Cybersecurity, or a related field preferred but not required. Relevant certifications such as OSCP, CSSLP, GWEB, or equivalent are a plus”
Lime is seeking an experienced Senior Security Engineer to join our Product Security team. In this role, you’ll be an embedded security partner to our engineering organization, directly contributing to the security of Lime’s software, APIs, mobile applications, and connected vehicle platforms across the full product lifecycle
You will report to the Director of Security Engineering and play a key role in building and maturing our product security program across a broad set of disciplines: from secure development and vulnerability management to application security assessments, detection engineering, and threat modeling
This is a unique opportunity to make a meaningful and visible impact on Lime’s security posture at an exciting stage of our growth
Application Security & Secure Development: Partner with engineering teams to perform security reviews, threat modeling, and risk assessments for product features, APIs, mobile applications, and backend services. Provide actionable and risk-calibrated guidance that helps Lime ship securely without slowing down
Security Tooling & Automation: Develop and maintain scalable security tools and pipelines to automate vulnerability detection, dependency scanning, and security testing across the software development lifecycle. Contribute to and extend our security pipeline and CI/CD security gates (SAST, DAST, SCA, secrets management)
Security Architecture & Design Reviews: Contribute to security architecture reviews for new product platforms and features. Evaluate authentication and authorization designs, API security posture, and data handling practices to ensure risks are identified and addressed early
Bug Bounty & External Programs: Support the operations of our BugCrowd bug bounty program, including triage, researcher communication, remediation coordination, and internal validation of reported findings
Incident Response: Serve as a product security point of contact for security incidents affecting Lime’s applications and services. Contribute to investigation, root-cause analysis, corrective action, and post-incident improvement
Cross-functional Partnership & Mentorship: Work closely with Software, Platform, Mobile, and Infrastructure engineering teams to embed security into development workflows. Share knowledge, drive security-by-default practices, and mentor engineers and peers on product security fundamentals
Stay Ahead of the Threat Landscape: Continuously evaluate emerging threats, vulnerabilities, and regulatory requirements (including EU CRA) relevant to Lime’s product and infrastructure stack. Bring proactive recommendations to the team
Participate in the team’s on-call rotation, responding to incidents, troubleshooting issues, and contributing to root cause analysis and service reliability improvements
Respond to and troubleshoot production issues, outages, and critical alerts during assigned on-call shifts
Escalate incidents as needed and collaborate with team members to restore service
Document issues and contribute to improvements that reduce recurring incidents
Be available to provide occasional after-hours, weekend, and holiday support while on call
Benefits
Disability insurance
401(k)
Preferred experience
We’re a fast-paced, lean, and remote-first company, so we’re looking for someone who thrives in an evolving environment, is a proactive problem-solver, and is passionate about building scalable and pragmatic security solutions for software-connected physical products
Technical Depth: Demonstrated expertise across core product and application security domains, including:
Communication: Clear written and verbal communicator who can translate complex technical security risks into actionable guidance for both engineering peers and non-technical stakeholders
Experience: 5+ years of experience in a dedicated product security, application security, or security engineering role, with a strong track record of hands-on technical contribution across the software development lifecycle
Exposure to regulatory frameworks relevant to connected products, such as EU CRA, UNECE WP.29, or OWASP MASVS
Secure development practices and SDLC security integration (SAST, DAST, SCA, secrets management)
Authentication and authorization patterns (OAuth, OIDC, RBAC)
Experience with detection engineering, security monitoring, or building detection-as-code (DaC) pipelines for product or application security threats (SIEM, log analysis, alert tuning)
Cloud security fundamentals (AWS, GCP) and container/infrastructure security
Mobile security (iOS, Android) and API security
Problem-Solver: Strong analytical skills with the ability to triage ambiguous security signals, identify meaningful risk, and propose pragmatic mitigations that teams can act on — without over-engineering or adding unnecessary friction
Team Player: Comfortable operating in a lean, remote-first, high-trust environment. Able to independently drive work forward while collaborating across engineering, product, and security teams
Vulnerability management tooling and processes
Experience operating or contributing to a vulnerability disclosure or bug bounty program
Education & Certifications: Bachelor’s degree in Computer Science, Cybersecurity, or a related field preferred but not required. Relevant certifications such as OSCP, CSSLP, GWEB, or equivalent are a plus
Familiarity with IoT, connected hardware, or vehicle/firmware security in a product security context
Ability to participate in a shared on-call rotation supporting production systems, including occasional after-hours, weekend, and holiday coverage, with responsibility for responding to critical alerts, coordinating escalations to restore service, and documenting issues to help prevent recurrence
Not sure if you meet all the qualifications? If this role excites you we encourage you to apply. Explore all opportunities on our career page
