Staff Software Engineer, Connected Device

ABOUT THE ROLE

Peloton inspires and motivates millions of people everyday. A key part of delivering on that mission is not only an amazing experience that our instructors and platforms provide, but also the data, telemetry, and insights that empower our customers to be the best version of themselves anywhere, anytime. Earning and maintaining our customers’ trust and safeguarding their data is key to everything we do. The Staff Software Engineer, Connected Device Security is instrumental in ensuring Peloton applications, devices and systems are implemented and secured with industry best practices. The candidate is an expert in the area of technical analysis and design. The candidate will help define the application security program, security policy and standards and will coordinate with engineering partners to ensure the security bar is upheld. The candidate will be instrumental in safeguarding the software and hardware that power our connected fitness devices, including the Bike, Tread, and future products. You’ll dive deep into our embedded systems architecture, identify potential vulnerabilities, and build robust security guardrails to protect our Members’ data and experience. The ideal candidate is a proven engineering leader that has both exemplary engineering and communication skills. They have extensive experience collaborating with internal engineering partners. They are a proven security technology and methodology expert that scales through enabling other engineering partners to make the right security design decisions and trade‑offs. They will work at the intersection of data science, cybersecurity, and software engineering to build intelligent defenses for modern digital threats.

YOUR DAILY IMPACT AT PELOTON

Architectural Security Review: Perform in‑depth security assessments and threat modeling of Peloton’s hardware and software architecture, from the bootloader to the application layer. Developer Guidance: Provide guidance and education to engineering and product teams on available security controls and their appropriate use to help prevent vulnerabilities. Develop Security Guardrails: Design, build, and implement security controls, services, and frameworks to proactively prevent security vulnerabilities in our embedded/Android‑based environment. Tooling & Automation: Build and deploy automated security tooling within the CI/CD pipeline/QA pipeline to integrate security seamlessly into the development lifecycle. Code & System Hardening: Collaborate directly with engineering teams to review code, identify security flaws, and provide concrete guidance for remediation. You will be hands‑on in developing secure coding practices and hardening our systems.

YOU BRING TO PELOTON

Strong software development background with 7+ years experience writing code in languages like Java, Kotlin, Swift or Python. You must be comfortable reading and writing code to identify and fix vulnerabilities. Android SDK: Proficient with the Android Software Development Kit (SDK), covering the full app lifecycle, integration of permissions, manifest configurations, inter‑app communication, user authentication, secure storage, and app signing practices. Android NDK: Solid grasp of the Android Native Development Kit (NDK) for analyzing and securing native code (C/C++), understanding JNI interactions, memory management, and mitigating native code vulnerabilities present in custom system components or high‑performance apps. AOSP (Android Open Source Project): Understanding of Android platform internals, custom ROM development, system‑level modifications, access control architecture, permission models, and relevant security configuration across OS layers. App Security and Assessment: Experience with tools for static and dynamic analysis (e.g., MobSF, Frida, Burp Suite), decompiling and reverse engineering APKs and shared libraries, vulnerability discovery and remediation, and OWASP MASVS or Mobile Top 10 standards. Framework and Native Interaction: Knowledge of how Java/Kotlin app layers communicate with underlying native components, including security issues introduced by third‑party SDKs, native libraries, and IPC mechanisms. Custom ROM Security Practices: Ability to identify and assess security misconfigurations unique to customized Android OS, differential analysis of ROM images, and review of device, kernel, and system‑level security features. Secure Coding: Familiarity with cryptography, secure storage, authentication methods (OAuth, JWT, biometrics), certificate pinning, and networking security (TLS/SSL), avoiding risky APIs, and enforcing proper app sandboxing. Familiarity with AWS cloud environments. Experience in a security engineering role is a nice to have, but not required. Excellent problem‑solving skills, with the ability to work independently and handle multiple tasks. The ability to drive clear next steps when encountering ambiguous spaces without clear lines of ownership. Exhibits a results‑oriented mindset, consistently delivering measurable improvements to the security posture of applications and systems. Excellent relationship building skills across diverse cross‑functional teams. Exceptional written and oral communication skills. Exceptional bias for action and ownership.

SALARY & BENEFITS

$215,050—$264,150 USD

Medical, dental and vision insurance Generous paid time off policy Short‑term and long‑term disability Access to Employee Assistance Program, including mental health services 401(k) including employer match Pet insurance and additional benefits Peloton is an equal opportunity employer and complies with all applicable federal, state, and local fair employment practices laws. Equal employment opportunity has been, and will continue to be, a fundamental principle at Peloton, where all team members, applicants, and other covered persons are considered on the basis of their personal capabilities and qualifications without discrimination because of race, color, religion, sex, age, national origin, disability, pregnancy, genetic information, military or veteran status, sexual orientation, gender identity or expression, marital and civil partnership/union status, alienage or citizenship status, creed, genetic predisposition or carrier status, unemployment status, familial status, domestic violence, sexual violence or stalking victim status, caregiver status, or any other protected characteristic as established by applicable law. This policy of equal employment opportunity applies to all practices and procedures relating to recruitment and hiring, compensation, benefits, termination, and all other terms and conditions of employment. Qualified applicants with arrest or conviction records will be considered for employment in accordance with the Los Angeles County Fair Chance Ordinance for Employers and the California Fair Chance Act, the City of Los Angeles Fair Chance Initiative for Hiring Ordinance and the San Francisco Fair Chance Ordinance, as applicable to applicants applying for positions in these jurisdictions. If you would like to request any accommodations from application through to interview, please email View email address on click.appcast.io. #J-18808-Ljbffr Dormont Manufacturing Co