Remote Security Champion Engineer: AI & API Gateways

VulnU; Lombardia; Hybrid; EUR 69,000 - 85,000; Full time

Benefits offered by this job

Hybrid work from Milan hub

Permanent contract

Bonus and welfare system

Job summary

Kong Inc., the AI Connectivity Company, is seeking a Senior Security Engineer (Security Champion) to join the Runtimes team. You will run security audits, threat modeling, and secure design reviews across our AI Gateway and API Gateway capabilities, and own vulnerability management end-to-end.

This role emphasizes writing real code with security baked in, collaborating with engineers, coaching on secure practices, and contributing to gateway features from day one.

Qualifications

• 3+ years building production software, with 2+ years in a dedicated security role (AppSec, vulnerability research, or pentesting).
• Solid coding skills in Rust, Java, Python, Go, or similar.
• Practical threat-modeling experience.
• Working knowledge of cybersecurity, especially L7 security and authentication.
• Basic knowledge of AI attack vectors.

Responsibilities

• Run security-focused code audits, threat modeling, and secure design reviews across our AI Gateway and API Gateway capabilities.
• Own vulnerability management end-to-end: triage, reproduction, remediation, verification.
• Partner with AI Gateway engineering on emerging AI/LLM threat patterns (prompt injection, data leakage, model abuse).
• Coach engineers on secure coding practices, turning security findings into lasting team habits.
• Contribute hands-on to Gateway feature work, with security built-in from day one.

Skills

Production software development

Security specialization

Threat modeling

Secure coding practices

Vulnerability management

AI security knowledge

Tools

Nginx/OpenResty/Envoy/Kong

Lua

Job description

Kong Inc., the AI Connectivity Company, is seeking a Senior Security Engineer (Security Champion) to join the Runtimes team. You will run security audits, threat modeling, and secure design reviews across our AI Gateway and API Gateway capabilities, and own vulnerability management end-to-end.

This role emphasizes writing real code with security baked in, collaborating with engineers, coaching on secure practices, and contributing to gateway features from day one.