ABOUT LVT
LVT lvt.com is redefining how businesses operate in the physical world, moving beyond traditional security solutions to deliver AI-driven, actionable intelligence that makes sites smarter, safer, and more secure. Since pioneering our first mobile, solar-powered units lvt.com, our commitment to scrappy, hands-on innovation has made us an established leader and one of the fastest-growing companies in intelligent site technology. We are building the next generation of solutions—from our physical units in the field to a powerful Agentic AI platform—that allows our customers to gain unprecedented visibility and control over safety, compliance, and operations. This is your chance to join a cutting-edge team lvt.com that isn't just watching the world change, but actively building the technology that is changing it.
We’re a team that’s focused on growth and innovation, and we’re proud that our crew, products, and leadership are being recognized for it.
- A Top-Tier Growth Company: Named one of the Financial Times’ Fastest Growing Companies 2025 and #10 on the Inc. 5000 Rocky Mountain Regional list for 2025.
- Innovative Leadership: Our CEO, Ryan Porter, was named an EY Entrepreneur of the Year 2025, and our CTO, Steve Lindsey, was inducted into the Silicon Slopes CTO Hall of Fame in 2024.
- Product & Software Excellence: We were named one of The Software Report’s Top 100 Software Companies of 2023 and are a winner of the Security Today Govies Award for 2025.
ABOUT THIS ROLE
At LVT, application security isn't an internal formality or a late-stage gate. We run a multi-tenant cloud platform, AI-driven video analytics, and license plate recognition pipelines, and we deploy thousands of solar-powered units everywhere from remote utility sites to busy retail parking lots, where anyone can walk up and touch the hardware. A tenant isolation bug, an unsigned firmware update, or a flaw in our analytics isn't just a ticket. It's a customer incident, a potential public headline, and a threat to public trust. We don't block innovation; we make high-speed execution safe.
We are seeking a Senior Manager, Application Security to own product security end-to-end across LVT's physical and digital architecture. This is a player-coach role: you will manage and mentor our existing application security engineers, hire 1–2 additional security engineers, and launch a Security Champions program across product teams. Reporting to our Director, Security Engineering, you will earn a standing seat in product and engineering planning, frame risk so clearly that engineering leaders take ownership of it, and design guardrails that make the secure path the easiest path. If you'd rather build the program than police it, this role offers direct organizational impact.
This role is based full-time in-office out of our Headquarters in American Fork, Utah.
ROLE RESPONSIBILITIES
- Team Leadership: Directly manage and mentor current AppSec engineers, hire and onboard 1–2 security engineers, and launch a cross-functional Security Champions program that scales your impact across every engineering squad.
- Product Security Ownership: Set the architecture and standards for LVT's full attack surface, from our multi-tenant cloud platform and partner APIs to mobile clients, computer vision pipelines, and solar-powered edge firmware.
- Engineering Partnership: Hold a standing seat in product design and planning, turning security risks into prioritized backlog items that engineering teams own and ship.
- Threat Modeling at Scale: Make threat modeling a core muscle that engineering squads run independently. Train teams on the fundamentals while staying hands-on for high-stakes system designs and edge/hardware boundaries.
- Tenant Isolation: Define, enforce, and test tenant boundaries across all platform services, deploying automated checks so cross-tenant data leaks never reach production.
- Secure SDLC Automation: Build security into CI/CD pipelines as code (SAST, SCA, secrets detection, IaC policy), delivering developer feedback in minutes, not sprints, with low noise and clear build-break rules.
- Edge & Firmware Security: Partner with hardware and embedded teams on device boot security, signed OTA update pipelines, edge credential management, and threat models that assume physical access.
- AI/ML & Analytics Security: Safeguard our AI vision models, prompt boundaries, and data pipelines against abuse, keeping privacy-by-design at the forefront in a regulated and publicly scrutinized space.
- AI-Assisted Development Standards: Define guardrails for how LVT engineers use AI coding agents, ensuring AI-generated code meets our standards for safety, testing, and architecture.
- Compliance as Engineering Artifacts: Turn real product security controls into audit evidence for SOC 2, GovRAMP, FedRAMP, and CJIS through native engineering workflows instead of manual compliance exercises.
- Incident Response & Disclosure: Oversee external vulnerability intake, triage, and coordinated disclosure (VDP/bug bounty), and lead engineering response to product security incidents.
- Observability & Systemic Defenses: Partner with SecOps to instrument telemetry for authorization failures and edge abuse, turning incident learnings into root-cause controls.
OUR IDEAL CANDIDATE
- The Player-Coach Mindset: 10+ years in AppSec or product security, including significant time as a hands-on engineer and 4+ years as a people manager or formal technical lead. You still read code, build automation, and hold your own in architecture reviews with principal engineers.
- Engineering Empathy: You know what it takes to ship software. You've carried a pager, hit deadlines, or maintained a release pipeline. You understand why shortcuts happen and spend your political capital wisely.
- Cross-Functional Influencer: You can point to releases or system architectures that changed because of an argument you made, and explain how you earned buy-in without pulling rank.
- Cloud & SaaS Depth: Deep technical grounding in multi-tenant authorization, zero-trust architectures, and API security at scale.
- Tooling & Code Fluency: Fluent in at least one language in our stack (e.g., Python, Go, TypeScript/Node, C/C++), with the ability to write custom automation, tooling, and CI integrations.
- Hardware & Firmware Exposure: Familiarity with IoT, embedded platforms, hardware security modules, or OTA update validation, or a proven ability to master physical attack surfaces quickly.
- AI/ML Security Literate: Understanding of model supply chain risks, data handling during inference, and security reviews for AI-augmented features.
- Metrics-Driven: You know the difference between a tool and a program. You measure success by coverage, adoption, defect recurrence, and remediation velocity.
- Location: Based onsite out of our headquarters in American Fork, Utah.
- Bonus Points: Experience in video streaming, computer vision, or physical safety products; hands-on work in regulated spaces (FedRAMP, GovRAMP, StateRAMP, CJIS); a track record scaling a formal Security Champions program or running a VDP/bug bounty.
BENEFITS
We believe you do your best work when your whole life is supported. We invest in our crew’s health, families, and financial futures with a benefits package designed to support you inside and outside the office. Full-time benefits include, but not limited to: Comprehensive health, dental and vision coverage, retirement benefits (401k match up to 4%), and flexible PTO.
LVT IS PROUD TO BE AN EQUAL OPPORTUNITY EMPLOYER. All applicants will be considered for employment without attention to race, color, religion, sex, sexual orientation, gender identity, national origin, veteran or disability status. All candidates must pass a drug screening and background check upon employment. Some roles may also require passing a federal background check and fingerprinting. Must be authorized to work in the U.S. If reasonable accommodation is needed to participate in the job application or interview process, and/or to perform essential job functions, please reach out to your recruiter.
Requirements
Must-haves
Engineering Partnership: Hold a standing seat in product design and planning, turning security risks into prioritized backlog items that engineering teams own and ship.
Threat Modeling at Scale: Make threat modeling a core muscle that engineering squads run independently. Train teams on the fundamentals while staying hands-on for high-stakes system designs and edge/hardware boundaries.
Tenant Isolation: Define, enforce, and test tenant boundaries across all platform services, deploying automated checks so cross-tenant data leaks never reach production.
Secure SDLC Automation: Build security into CI/CD pipelines as code (SAST, SCA, secrets detection, IaC policy), delivering developer feedback in minutes, not sprints, with low noise and clear build-break rules.
Edge & Firmware Security: Partner with hardware and embedded teams on device boot security, signed OTA update pipelines, edge credential management, and threat models that assume physical access.
AI/ML & Analytics Security: Safeguard our AI vision models, prompt boundaries, and data pipelines against abuse, keeping privacy-by-design at the forefront in a regulated and publicly scrutinized space.
AI-Assisted Development Standards: Define guardrails for how LVT engineers use AI coding agents, ensuring AI-generated code meets our standards for safety, testing, and architecture.
Compliance as Engineering Artifacts: Turn real product security controls into audit evidence for SOC 2, GovRAMP, FedRAMP, and CJIS through native engineering workflows instead of manual compliance exercises.
Incident Response & Disclosure: Oversee external vulnerability intake, triage, and coordinated disclosure (VDP/bug bounty), and lead engineering response to product security incidents.
Observability & Systemic Defenses: Partner with SecOps to instrument telemetry for authorization failures and edge abuse, turning incident learnings into root-cause controls.
Engineering Empathy: You know what it takes to ship software. You've carried a pager, hit deadlines, or maintained a release pipeline. You understand why shortcuts happen and spend your political capital wisely.
Cross-Functional Influencer: You can point to releases or system architectures that changed because of an argument you made, and explain how you earned buy-in without pulling rank.
Cloud & SaaS Depth: Deep technical grounding in multi-tenant authorization, zero-trust architectures, and API security at scale.
Tooling & Code Fluency: Fluent in at least one language in our stack (e.g., Python, Go, TypeScript/Node, C/C++), with the ability to write custom automation, tooling, and CI integrations.
Hardware & Firmware Exposure: Familiarity with IoT, embedded platforms, hardware security modules, or OTA update validation, or a proven ability to master physical attack surfaces quickly.
AI/ML Security Literate: Understanding of model supply chain risks, data handling during inference, and security reviews for AI-augmented features.
Metrics-Driven: You know the difference between a tool and a program. You measure success by coverage, adoption, defect recurrence, and remediation velocity.
Location: Based onsite out of our headquarters in American Fork, Utah.
Nice-to-haves
None flagged.
Application prep
Use the role’s language and application details while tailoring your materials.