Senior Security Engineer, Product Security

The Opportunity at Komodo Health

The Security team protects Komodo Health's data, platform and people. We run application and cloud security, vulnerability management, detection and response, and our SOC 2 program. We partner with engineering teams so the secure path is also the fastest one. This role sits in Security, works day to day with Product Security, and supports both our Engineering teams and our Forward Deployed Engineering (FDE) team.

This role gives Product Security deep engineering capacity for two groups: the Engineering teams that build our products, and the FDE team that deploys them into customer cloud environments. You will own the security of how Komodo builds, ships and deploys software: GitHub, CI/CD pipelines, SAST, SCA and DAST, and the AI features and coding agents our teams now ship with. Success means accurate findings reach engineers early, remediation scales through automation and secure defaults instead of tickets, AI features launch with guardrails designed in, and product-security metrics show measurable risk reduction.

You join while Komodo is putting LLM features into its products and AI agents into its engineering workflow, so you will help set the patterns everyone else follows. You will write code as much as you review it, and your work will show up in every repository and every release.

Looking back on your first 12 months at Komodo Health, you will have…

Established a trusted, scalable security-testing path across Komodo’s products and repositories, enabling engineers to identify and address security issues earlier.

Strengthened Komodo’s software supply chain and delivery practices through secure defaults, appropriate access controls, and resilient deployment patterns.

Established practical security patterns and guardrails for AI-enabled products and AI-assisted engineering workflows.

Reduced confirmed, exploitable risk across our products, prioritized by reachability, exposure and impact rather than raw CVE counts, and tracked with product-security metrics such as time to remediate confirmed findings and repeat-finding rates. Help define and improve the vulnerability-intake operating model, including appropriate handling of urgent findings.

Used AI and automation to speed up triage and remediation, with defined human review gates for decisions that carry risk.

You will accomplish these outcomes through the following responsibilities…

Own the application security toolchain (SAST, SCA, container and secret scanning, DAST): configuration, custom rules, and a false-positive rate engineers can live with.

Build security automation in Python or TypeScript and GitHub Actions: policy-as-code checks, auto-triage and fix pull requests.

Run threat models and design reviews for new services and AI features, and review high-risk pull requests.

Improve how Security engages across the product lifecycle: get involved early in new products, major changes, AI features and customer deployments, partner with Engineering and FDE teams on designs and fixes, and represent product security in customer security reviews.

Reduce engineering friction and help ensure sufficient engineering capacity for timely security remediation.

Scope penetration tests, validate their findings and verify the fixes.

Evaluate AI security tooling and coach engineers on secure LLM, LLM Gateways, MCP, RAG and agent patterns.

Keep SDLC and vulnerability management controls audit-ready for SOC 2, and join the security on-call rotation.

Projects you would join:

AI runtime security proof of concept for our production LLM features

AI agents that triage, investigate and remediate vulnerability findings end to end

Threat models of core product services

Penetration test remediation across our products

Dependency and container vulnerability burn-down in product infrastructure repositories

Security baseline for our products deployed into customer cloud accounts

What you bring to Komodo Health (Required):

Engineering depth: 6+ years in software or security engineering, 3+ of them in application or product security, shipping production code in Python, TypeScript, Go or Java.

GitHub and CI/CD: hands-on GitHub Actions at scale (reusable workflows, OIDC, secrets, self-hosted runners), and a working model of pipeline attacks such as poisoned pipeline execution, dependency confusion and compromised actions, with their defenses (pinning, SBOMs, artifact signing, SLSA).

SAST and SCA: ran a scanning program across many repositories, wrote custom rules, and prioritized by reachability and exploitability rather than raw severity.

Penetration testing and DAST: hands-on penetration testing of web apps and APIs, authenticated DAST, and the judgment to confirm or dismiss a finding; fluent in the OWASP Top 10 and API Security Top 10.

AI security: hands-on securing of LLM applications or agents against prompt injection, data leakage, insecure output handling and excessive agency (OWASP Top 10 for LLM Applications); you use AI coding assistants in your own daily work.

Threat modeling: structured threat modeling and secure design review of services and AI features, using methods such as STRIDE and AI-focused frameworks such as MAESTRO.

Cloud: hands-on security work in at least one of AWS, GCP or Azure, covering identity and access, network controls, containers and infrastructure as code.

Partnership: you have embedded with engineering teams and shipped fixes in their codebases rather than handing over findings. You influence without authority, explain risk in business terms, write clear documentation and own outcomes end to end.

Additional skills and experience we’d prioritize (nice to have)…

Built or operated AI agents for security work (for example LLM-based triage or automated fix pull requests)

Experience with AI runtime protection or LLM gateway products

Bug bounty background, published CVEs, talks or open-source security tools

SOC 2 experience with SDLC and vulnerability management controls

Detection engineering for application-layer threats in a SIEM

Previous experience at a healthcare or data platform company

Forward deployed or customer-facing work: securing deployments in customer-owned cloud accounts and supporting enterprise customer security reviews

Multi-cloud depth across AWS, GCP and Azure

Certifications are a plus, not a substitute for hands-on work: application security certifications such as OSWE or GWAPT, and AWS, GCP or Azure security certifications

#LI-Remote

The pay range for each job posting reflects a minimum and maximum range of annual base pay that we reasonably expect to pay for this position within the US. We carefully consider multiple business-related factors when determining compensation, including job-related skills, work experience, geographic work location, relevant training and certifications, business needs and market demands.

The starting annual base pay for this role is listed below. This position may be eligible for performance-based bonuses as determined in the Company’s sole discretion and in accordance with a written agreement or plan. This role may also be eligible for equity awards. In addition, this role is eligible for benefits including, but not limited to, comprehensive health, dental, and vision insurance; flexible time off and holidays; 401(k) with company match; disability insurance and life insurance; and leaves of absence in accordance with applicable state and local laws and regulations and company policy.

San Francisco Bay Area and New York City:

$200,000—$245,000 USD

All Other US Locations:

$174,000—$215,000 USD