Senior Security Engineer, Product Security
Komodo Health · United States
About this role
**Senior Security Engineer, Product Security** **About Komodo Health** Komodo Health’s mission is to reduce the global burden of disease. We build the Healthcare Map—an industry-leading view of the U.S. healthcare system—by combining de-identified, real-world patient data with innovative algorithms and decades of clinical experience. **The Opportunity** The Security team protects Komodo’s data, platform, and people. You’ll work on application and cloud security, vulnerability management, detection and response, and our SOC 2 program—partnering closely with engineering to make the secure path the fastest path. This role provides deep engineering capacity for: - Product engineering teams that build our products - Forward Deployed Engineering (FDE) that deploys into customer cloud environments You’ll own security across how Komodo builds, ships, and deploys software—covering GitHub, CI/CD, SAST/SCA/DAST, and the AI features and coding agents our teams ship with. **What success looks like** - Accurate findings reach engineers early - Remediation scales via automation and secure defaults (not ticket backlogs) - AI features launch with guardrails designed in - Product-security metrics show measurable risk reduction **What you’ll do (Responsibilities)** - Own the application security toolchain (SAST, SCA, container & secret scanning, DAST): configuration, custom rules, and acceptable false-positive rates - Build security automation in **Python or TypeScript** and **GitHub Actions** (policy-as-code checks, auto-triage, fix PRs) - Run threat models and design reviews for new services and AI features; review high-risk PRs - Improve Security engagement across the product lifecycle (early involvement, partner with Engineering & FDE, represent product security in customer security reviews) - Reduce engineering friction and ensure capacity for timely security remediation - Scope penetration tests, validate findings, and verify fixes - Evaluate AI security tooling and coach engineers on secure LLM/LLM gateway/MCP/RAG/agent patterns - Keep SDLC and vulnerability management controls audit-ready for SOC 2; join the security on-call rotation **Projects you may join** - AI runtime security proof of concept for production LLM features - AI agents that triage, investigate, and remediate vulnerability findings end to end - Threat models of core product services - Penetration test remediation across products - Dependency and container vulnerability burn-down in product infrastructure repos - Security baseline for products deployed into customer cloud accounts **What you bring (Required)** - **6+ years** in software or security engineering; **3+** in application/product security; shipping production code in **Python, TypeScript, Go, or Java** - Hands-on **GitHub Actions at scale** (reusable workflows, OIDC, secrets, self-hosted runners) and knowledge of pipeline attacks (poisoned pipeline execution, dependency confusion, compromised actions) with defenses (pinning, SBOMs, artifact signing, SLSA) - Experience running **SAST/SCA** across many repos, writing custom rules, and prioritizing by reachability/exploitability - Hands-on **penetration testing** of web apps/APIs, authenticated DAST, and judgment to confirm/dismiss findings; fluent in OWASP Top 10 and API Security Top 10 - Hands-on **AI security** for LLM apps/agents (prompt injection, data leakage, insecure output handling, excessive agency) and use of AI coding assistants - Structured **threat mod
Listing freshness
CronJobs last confirmed this listing 51m ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.