Senior Security Engineer, Product Security

Komodo Health

2d•$174,000 - $245,000•Hybrid

About The Position

Komodo Health is seeking a Senior Security Engineer to strengthen product security across the company’s products and customer deployments. The role is part of the Security team, works day to day with Product Security, and supports Engineering and Forward Deployed Engineering (FDE). The engineer will own security practices for how Komodo builds, ships, and deploys software, including GitHub, CI/CD pipelines, security testing, and AI features and coding agents. The role focuses on building scalable security testing and automation, strengthening software supply-chain practices, and establishing practical security guardrails for AI-enabled products and AI-assisted engineering. The engineer will work closely with engineering teams to make security findings accurate and actionable, promote remediation through automation and secure defaults, and track measurable reductions in exploitable product risk. The role also contributes to vulnerability intake, remediation practices, customer deployments, and SOC 2 readiness. The position involves writing and reviewing production code, running threat models and design reviews, evaluating AI security tooling, and partnering with Engineering and FDE teams throughout the product lifecycle. The engineer will also participate in the security on-call rotation and represent product security in customer security reviews.

Requirements

At least 6 years of software or security engineering experience, including at least 3 years in application or product security.
Experience shipping production code in Python, TypeScript, Go, or Java.
Hands-on experience operating GitHub Actions at scale, including reusable workflows, OIDC, secrets, and self-hosted runners.
Understanding of pipeline attack methods, including poisoned pipeline execution, dependency confusion, and compromised actions, and defenses such as pinning, SBOMs, artifact signing, and SLSA.
Experience running a SAST and SCA scanning program across many repositories, writing custom rules, and prioritizing findings by reachability and exploitability rather than raw severity.
Hands-on experience with web application and API penetration testing, authenticated DAST, and confirming or dismissing findings.
Fluency in the OWASP Top 10 and API Security Top 10.
Hands-on experience securing LLM applications or agents against prompt injection, data leakage, insecure output handling, and excessive agency, including awareness of the OWASP Top 10 for LLM Applications.
Use of AI coding assistants in daily work.
Experience with structured threat modeling and secure design reviews for services and AI features, using methods such as STRIDE and AI-focused frameworks such as MAESTRO.
Hands-on security experience in at least one of AWS, GCP, or Azure, including identity and access, network controls, containers, and infrastructure as code.
Experience embedding with engineering teams and shipping fixes in their codebases rather than merely handing over findings.
Ability to influence without authority, explain risk in business terms, write clear documentation, and own outcomes end to end.

Nice To Haves

Built or operated AI agents for security work, such as LLM-based triage or automated fix pull requests.
Experience with AI runtime protection or LLM gateway products.
Bug bounty experience, published CVEs, security talks, or open-source security tools.
SOC 2 experience with SDLC and vulnerability management controls.
Detection engineering for application-layer threats in a SIEM.
Experience at a healthcare or data platform company.
Forward-deployed or customer-facing experience securing deployments in customer-owned cloud accounts and supporting enterprise customer security reviews.
Multi-cloud experience across AWS, GCP, and Azure.
Application security certifications such as OSWE or GWAPT, or AWS, GCP, or Azure security certifications.

Responsibilities

Own and configure the application security toolchain, including SAST, SCA, container and secret scanning, and DAST; develop custom rules and maintain a manageable false-positive rate.
Build security automation using Python or TypeScript and GitHub Actions, including policy-as-code checks, automated triage, and fix pull requests.
Conduct threat modeling and design reviews for new services and AI features, and review high-risk pull requests.
Engage with products early in their lifecycle and during major changes, AI feature development, and customer deployments; partner with Engineering and FDE teams on designs and fixes.
Represent product security in customer security reviews.
Reduce engineering friction and help ensure sufficient engineering capacity for timely security remediation.
Scope penetration tests, validate findings, and verify that fixes have been completed.
Evaluate AI security tooling and coach engineers on secure LLM, LLM Gateway, MCP, RAG, and agent patterns.
Maintain audit-ready SDLC and vulnerability management controls for SOC 2.
Participate in the security on-call rotation.
Help define and improve the vulnerability-intake operating model, including appropriate handling of urgent findings.
Use AI and automation to speed up triage and remediation, with defined human review gates for consequential decisions.
Establish and improve security testing across products and repositories, software supply-chain practices, and security patterns for AI-enabled products and AI-assisted workflows.
Reduce confirmed, exploitable product risk using reachability, exposure, and impact, and track product-security metrics such as time to remediate confirmed findings and repeat-finding rates.