LiveView Technologies - Senior Manager, Application Security
Requirements
• The Player-Coach Mindset: 10+ years in AppSec or product security, including significant time as a hands-on engineer and 4+ years as a people manager or formal technical lead. You still read code, build automation, and hold your own in architecture reviews with principal engineers. • Engineering Empathy: You know what it takes to ship software. You've carried a pager, hit deadlines, or maintained a release pipeline. You understand why shortcuts happen and spend your political capital wisely. • Cross-Functional Influencer: You can point to releases or system architectures that changed because of an argument you made, and explain how you earned buy-in without pulling rank. • Cloud & SaaS Depth: Deep technical grounding in multi-tenant authorization, zero-trust architectures, and API security at scale. • Tooling & Code Fluency: Fluent in at least one language in our stack (e.g., Python, Go, TypeScript/Node, C/C++), with the ability to write custom automation, tooling, and CI integrations. • Hardware & Firmware Exposure: Familiarity with IoT, embedded platforms, hardware security modules, or OTA update validation, or a proven ability to master physical attack surfaces quickly. • AI/ML Security Literate: Understanding of model supply chain risks, data handling during inference, and security reviews for AI-augmented features. • Metrics-Driven: You know the difference between a tool and a program. You measure success by coverage, adoption, defect recurrence, and remediation velocity. • Location: Based onsite out of our headquarters in American Fork, Utah. • Bonus Points: Experience in video streaming, computer vision, or physical safety products; hands-on work in regulated spaces (FedRAMP, GovRAMP, StateRAMP, CJIS); a track record scaling a formal Security Champions program or running a VDP/bug bounty.
Responsibilities
• Team Leadership: Directly manage and mentor current AppSec engineers, hire and onboard 1–2 security engineers, and launch a cross-functional Security Champions program that scales your impact across every engineering squad. • Product Security Ownership: Set the architecture and standards for LVT's full attack surface, from our multi-tenant cloud platform and partner APIs to mobile clients, computer vision pipelines, and solar-powered edge firmware. • Engineering Partnership: Hold a standing seat in product design and planning, turning security risks into prioritized backlog items that engineering teams own and ship. • Threat Modeling at Scale: Make threat modeling a core muscle that engineering squads run independently. Train teams on the fundamentals while staying hands-on for high-stakes system designs and edge/hardware boundaries. • Tenant Isolation: Define, enforce, and test tenant boundaries across all platform services, deploying automated checks so cross-tenant data leaks never reach production. • Secure SDLC Automation: Build security into CI/CD pipelines as code (SAST, SCA, secrets detection, IaC policy), delivering developer feedback in minutes, not sprints, with low noise and clear build-break rules. • Edge & Firmware Security: Partner with hardware and embedded teams on device boot security, signed OTA update pipelines, edge credential management, and threat models that assume physical access. • AI/ML & Analytics Security: Safeguard our AI vision models, prompt boundaries, and data pipelines against abuse, keeping privacy-by-design at the forefront in a regulated and publicly scrutinized space. • AI-Assisted Development Standards: Define guardrails for how LVT engineers use AI coding agents, ensuring AI-generated code meets our standards for safety, testing, and architecture. • Compliance as Engineering Artifacts: Turn real product security controls into audit evidence for SOC 2, GovRAMP, FedRAMP, and CJIS through native engineering workflows instead of manual compliance exercises. • Incident Response & Disclosure: Oversee external vulnerability intake, triage, and coordinated disclosure (VDP/bug bounty), and lead engineering response to product security incidents. • Observability & Systemic Defenses: Partner with SecOps to instrument telemetry for authorization failures and edge abuse, turning incident learnings into root-cause controls.
Benefits
• We believe you do your best work when your whole life is supported. We invest in our crew’s health, families, and financial futures with a benefits package designed to support you inside and outside the office. Full-time benefits include, but not limited to: Comprehensive health, dental and vision coverage, retirement benefits (401k match up to 4%), and flexible PTO.
Apply in one click
Upload My Resume
Drop here or click to browse · Tap to choose · PDF, DOCX, DOC, RTF, TXT