Lead Security Engineer

Lawn Starter is the nation’s leading on-demand marketplace for lawn care and outdoor services, with over $100M in annual bookings. We’re expanding beyond lawn care to become the one-stop shop for all home services — operating across three brands (Lawn Starter, Lawn Love, Home Gnome) on a single shared platform, with customers and pros on both sides and real money moving every day.

Security is already part of how we build — today it’s owned by our Cloud & Dev Ops team, who’ve kept it solid as we’ve scaled. As we grow a $100M+ marketplace that processes payments, holds customer and pro data, and runs on AWS — and as AI agents let us ship faster than ever — we’re ready to take security to the next level with a dedicated leader.

You’d be that person: the lead who takes security from a distributed, informal practice to a deliberate, instrumented one, and who sets the multi-year direction the org — and eventually a team — follows. You’ll partner closely with the delivery teams and with Cloud & Dev Ops, and you’ll start by doing most of the heavy lifting yourself, with the autonomy of a founding hire and the backing of an engineering org that already cares about getting this right.

Part of the job is building security so it can outgrow one person: the standards, playbooks, and hiring bar you lay down now are the foundation for the team you’ll grow into leading.

You lead security at Lawn Starter end-to-end: the PHP/Laravel and Type Script/React codebase, the AWS infrastructure, the payments and customer-data flows, and the compliance posture. You set the multi-year direction, build the controls, and are the person the org looks to on every security question.

You start hands-on — security-of-one for now — with an explicit path to leading a small team within roughly 12-18 months, once the foundation is solid and the first hire makes sense. This isn’t a hands-off management role: you lead by doing first. You’ll collaborate heavily with the delivery teams and lean on Cloud & Dev Ops where it helps, but most of the heavy lifting is yours today.

So you’ll prioritize ruthlessly, automate hard, and pick the few things that actually reduce risk over the long list that merely looks thorough.

• You lead the function.
  
  You’ll take security from a distributed, informal practice to a deliberate, instrumented one — threat models, automated scanning, incident runbooks — all bearing your design, and all built to scale past you.

• You span every layer.
  
  App Sec one day, AWS IAM the next, PCI scoping the day after. Breadth is the job, not a stretch.

• You secure an AI-agent codebase.
  
  Most new code here is authored by AI agents. Keeping that safe — at speed — is a problem most security engineers haven’t faced yet.

• You build for the team you’ll grow.
  
  You’re not just solving today’s problem; you’re laying the standards, playbooks, and hiring bar for the security team you’ll lead next.

• You set the bar.
  
  You’re the lead security voice, and the standard for the org — and its future team — is the one you define and champion.
  What You’ll Own

• Application security— threat modeling the critical path, secure-SDLC practices, code and design review, SAST/secret-scanning/dependency-scanning in CI, and a vulnerability-management loop that actually closes findings.

• Cloud & infrastructure security— AWS posture (IAM, network, encryption), secrets management, EKS/Kubernetes hardening, partnering with Cloud & Dev Ops on the guardrails that keep misconfigurations out of production.

• Compliance & data protection— mapping PCI scope for payments, driving SOC 2 and LGPD readiness, vendor risk, and being the person who can confidently answer a customer or auditor security…