Security Engineer, Corporate Security

At Lyft, our purpose is to serve and connect. We aim to achieve this by cultivating a work environment where all team members belong and have the opportunity to thrive. 

Lyft connects people to transportation to change the way we live and get around our communities. Lyft’s engineering team is growing rapidly, and we are looking for Security Engineers to help us scale. Come be part of a new team at Lyft focused on enabling and empowering engineering teams to deliver at scale.

Our drivers and passengers entrust Lyft with their personal information and travel details to get where they're going and expect us to keep that data safe. Lyft's security team leads efforts across the company to ensure our systems are secure and worthy of our users' trust.

The security team designs and builds Lyft's security architecture, consult with other teams as they build and launch new products and features, proactively plans for the unexpected, and responds to incidents that occur. Our work affects the entire company and takes place at all levels of the stack, from infrastructure to web application security, as well as mobile apps, IT, and autonomous vehicles. We try to approach security from a software engineering standpoint. We believe in scaling security through automation and tooling and we ship frequently. Check out our blog posts at https://eng.lyft.com/tagged/security to learn more about some of the things we’ve built.

We're looking for an engineer to own the security of the systems Lyft employees rely on every day: identity, endpoints, and the data that moves between them. Corporate Security sits where security meets IT, so the work spans detection engineering, platform operations, and the automation that ties them together. We'd rather write code than file tickets, and we measure ourselves on control coverage and time-to-remediate. If you want real ownership over how security works at company scale, this is that role.

• →Collaborate with teams across Lyft to ensure security best practices are leveraged as we roll out new features and expand our service offerings
• →Own the security posture of Lyft's SSO/MFA platform: authentication policies, device trust and posture checks, MFA factor strategy, and phishing-resistant authentication rollout. 
• →Proactively research new attack vectors that may affect Lyft
• →Develop detections for identity-based attacks: MFA fatigue, session token theft, phishing-driven account takeover, and abuse of privileged admin roles
• →Deploy, tune, and operate Lyft's EDR platform across macOS and Windows fleets, balancing detection efficacy against user experience and endpoint performance
• →Own the operational health of the agent fleet: coverage gaps, version and policy drift, check-in failures, and remediation workflows with IT
• →Operate and tune Lyft's DLP tooling to detect and prevent unsanctioned movement of company data
• →Write code to integrate corporate security tooling, pushing telemetry into the data platform, enriching alerts, and automating response so that detection and remediation scale without headcount
• →Build and maintain relationships with key partners both internally and externally
• →Define and report metrics on control coverage, detection efficacy, and mean time to remediate; present findings and recommendations to engineering and leadership
• →Contribute to on-call rotation and participate in incident response, including postmortems and follow-up remediation
• →Produce runbooks and documentation that make investigations repeatable by anyone on the team

• Hands-on experience operating enterprise identity platforms (Okta, Entra ID, Duo) — authentication policy, device trust, MFA factor strategy, lifecycle automation via SCIM or API
• Experience deploying and tuning EDR at fleet scale (SentinelOne, CrowdStrike, Defender) across mixed macOS and Windows environments
• Ability to write detection logic and investigate endpoint telemetry — process trees, file and network activity, authentication events
• Development skills in Python, Go, or similar to automate data exchange between security and IT tooling, and to build response automation
• Working knowledge of macOS and Windows internals: process execution, persistence mechanisms, code signing, and native security controls
• Present findings, recommendations and results to leadership
• Ability to communicate complex information, concepts, or ideas in a confident and well-organized manner through verbal, written, and/or visual means
• Ability to manage multiple tasks and priorities
• Ability to work independently with minimal supervision

Please submit your resume in English.