Planned hiring
Product Security Engineer
Lucy is a proactive AI coach from Lucy Labs that lives on your desktop as a cloud-backed app.
Planned hiring. This description explains the work we are preparing to hire for; it is not a confirmed start date or offer.
Build and verify the technical security and privacy controls that make Lucy trustworthy with evidence of people's work. You will translate approved requirements into engineering designs, working protections and reproducible tests across desktop collection, service processing, stored data and user or manager views. The essential controls must be in place before customer data enters the affected product path.
The role
Build and verify the technical security and privacy controls that make Lucy trustworthy with evidence of people's work. You will translate approved requirements into engineering designs, working protections and reproducible tests across desktop collection, service processing, stored data and user or manager views. The essential controls must be in place before customer data enters the affected product path.
What you will build
- Threat-model the journey from desktop capture through ingestion, Context extraction, knowledge, coaching and administration. Identify assets, trust boundaries, abuse cases and likely failures, then prioritize concrete mitigations with component owners.
- Engineer and test permission, pause and collection controls with Desktop and Management engineers. Verify that denied or revoked access and unavailable privacy dependencies produce the required safe behavior, including after restart and during upgrades.
- Design and verify sensitive-data filtering, data-loss prevention, de-identification and content-minimized telemetry. Test leakage paths in logs, traces, queues, prompts and diagnostics as well as the normal user interface.
- Specify and test separate data-retention policies, individual deletion and organization-exit behavior with Data Engineering. Trace obligations through retained records, derived stores, caches and recovery paths; do not assume deleting a source row removes every copy.
- Verify tenant isolation, service authorization, user access and manager visibility. Test the configured team-size gate and permitted individual opt-in, while ensuring managers never receive individual prompts or Content feeds.
- Review organization tool-policy enforcement and AI-specific attack surfaces with AI Engineering, including untrusted retrieved material, instruction injection and unintended disclosure. Build regression cases that challenge the controls rather than only exercising the intended workflow.
- Investigate vulnerabilities, help contain security incidents and verify remediation. Produce accurate technical evidence for enterprise reviews and compliance colleagues, with limitations and unresolved risks clearly stated.
How ownership works
Product Security owns technical control design and verification. Desktop, Product, Data and Platform engineers implement and maintain protections in their components with you; they retain responsibility for secure code and tests. QA integrates security evidence into release assessment. Legal and GRC own legal interpretation, privacy-policy authority and certification administration. This role supplies engineering evidence and escalates ambiguity to them; it does not declare certification or decide policy through implementation. Corporate IT and routine customer support are separate responsibilities.
Before a dedicated hire, a qualified named engineer must have a bounded security allocation and an appropriate review path. That work consumes delivery capacity and transfers explicitly when this specialist joins.
What you bring
- Demonstrated product-security engineering, threat modeling and hands-on remediation across applications, APIs or desktop software.
- Experience testing privacy-sensitive data flows, authorization boundaries and data lifecycle controls, including negative cases and partial failures.
- Programming skills sufficient to build protections and reproducible tests, inspect implementation and assess AI-generated code critically.
- Clear communication about exploitability, customer impact and residual risk. You can work constructively with builders while maintaining independent scrutiny of control claims.
Your first 90 days
Map the first product slice's sensitive-data journey and produce a prioritized threat model with named owners. Implement and verify a critical control with its component team. Demonstrate permission, tenant-boundary and deletion failure tests with QA, and create a concise control-evidence record showing remaining gaps and release dependencies.
Next step
Express your interest
Email people@lucylabs.ai with the role title, a short introduction and relevant CV or portfolio. This is planned hiring; we will confirm current availability and the individual working arrangement.
Lucy Labs confirms the working arrangement, employer, location, eligibility, compensation and terms for each role. Our mailing address does not determine the job location or guarantee remote employment, worldwide eligibility or visa sponsorship.
Do not send passwords, government identifiers or bank details. Read the application privacy notice.
Frequently asked questions
Is this role open at Lucy Labs?
Lucy Labs lists this role as planned hiring. Availability depends on the need, team readiness and individual arrangement; it does not promise an immediate vacancy or start date.
Where does this work take place at Lucy Labs?
Lucy Labs confirms the working arrangement, employer, location, eligibility, compensation and terms for each role. Our mailing address does not determine the job location or guarantee remote employment, worldwide eligibility or visa sponsorship.
What does this role own at Lucy Labs?
Lucy Labs: Build and verify the technical security and privacy controls that make Lucy trustworthy with evidence of people's work. You will translate approved requirements into engineering designs, working protections and reproducible tests across desktop collection, service processing, stored data and user or manager views. The essential controls must be in place before customer data enters the affected product path.
How do I express interest in Lucy Labs?
Email people@lucylabs.ai with the role title, a short introduction and relevant CV or portfolio. Lucy Labs uses the application to assess and respond to it; retention for future opportunities is a separate explained purpose and choice.
