Senior Security Engineer, Product Security

VulnU; United States; Hybrid; USD 174,000 - 245,000; Full time

Benefits offered by this job

Flexible PTO

Retirement match

Equity

Job summary

Komodo Health is seeking a Senior Security Engineer in Product Security to own the security toolchain, build automation, and lead threat modeling for core services and AI features. You will work with Engineering and FDE to reduce risk and improve secure delivery across our software lifecycle.

You will apply hands-on security testing, ensure secure defaults, and drive scalable processes for vulnerability management and incident response while partnering with teams across the product stack.

Qualifications

• 6+ years in software or security engineering, with 3+ years in application security.
• Production code experience in Python, TypeScript, Go or Java.
• Hands-on GitHub Actions at scale with reusable workflows and secrets management.
• SAST and SCA scanning across many repositories with custom rules.
• Penetration testing and DAST of web apps and APIs, OWASP Top 10 oriented.
• AI security for LLM applications and AI agents, with secure design practices.
• Threat modeling using STRIDE and MAESTRO frameworks.
• Cloud security across AWS, GCP or Azure, including IAM and IaC.

Responsibilities

• Own the application security toolchain (SAST, SCA, container and secret scanning, DAST): configuration and rules.
• Build security automation in Python or TypeScript and GitHub Actions; policy-as-code checks.
• Run threat models and design reviews for new services and AI features; review risky PRs.
• Improve security engagement across the product lifecycle with engineering teams.
• Reduce engineering friction and ensure timely security remediation.
• Scope penetration tests, validate findings and verify fixes.
• Evaluate AI security tooling and coach engineers on secure LLM patterns.
• Keep SOC 2 controls and vulnerability management audit-ready; participate in on-call rotation.

Skills

Engineering depth

GitHub Actions

SAST

DAST

Threat modeling

AI security

Cloud security

Tools

GitHub

CI/CD

Secrets management

OWASP ZAP

Job description

# Senior Security Engineer, Product SecurityKomodo Health · komodohealth.comCategory: Application SecurityLocation: United StatesLevel: Senior## Quality of lifeWhat the posting states. Hover or tap a perk to see the line it came from.* Flexible PTO* Retirement match* EquityWe Breathe Life Into DataAt Komodo Health, our mission is to reduce the global burden of disease. And we believe that smarter use of data is essential to this mission. That’s why we built the Healthcare Map — the industry’s largest, most complete, precise view of the U.S. healthcare system — by combining de-identified, real-world patient data with innovative algorithms and decades of clinical experience. The Healthcare Map serves as our foundation for a powerful suite of software applications, helping us answer healthcare’s most complex questions for our partners. Across the healthcare ecosystem, we’re helping our clients unlock critical insights to track detailed patient behaviors and treatment patterns, identify gaps in care, address unmet patient needs, and reduce the global burden of disease.As we pursue these goals, it remains essential to us that we stay grounded in our values: be awesome, seek growth, deliver “wow,” and enjoy the ride. At Komodo, you will be joining a team of ambitious, supportive Dragons with diverse backgrounds but a shared passion to deliver on our mission to reduce the burden of disease — and enjoy the journey along the way.The Opportunity at Komodo HealthThe Security team protects Komodo Health's data, platform and people. We run application and cloud security, vulnerability management, detection and response, and our SOC 2 program. We partner with engineering teams so the secure path is also the fastest one. This role sits in Security, works day to day with Product Security, and supports both our Engineering teams and our Forward Deployed Engineering (FDE) team.This role gives Product Security deep engineering capacity for two groups: the Engineering teams that build our products, and the FDE team that deploys them into customer cloud environments. You will own the security of how Komodo builds, ships and deploys software: GitHub, CI/CD pipelines, SAST, SCA and DAST, and the AI features and coding agents our teams now ship with. Success means accurate findings reach engineers early, remediation scales through automation and secure defaults instead of tickets, AI features launch with guardrails designed in, and product-security metrics show measurable risk reduction.You join while Komodo is putting LLM features into its products and AI agents into its engineering workflow, so you will help set the patterns everyone else follows. You will write code as much as you review it, and your work will show up in every repository and every release.Looking back on your first 12 months at Komodo Health, you will have...Established a trusted, scalable security-testing path across Komodo’s products and repositories, enabling engineers to identify and address security issues earlier.Strengthened Komodo’s software supply chain and delivery practices through secure defaults, appropriate access controls, and resilient deployment patterns.Established practical security patterns and guardrails for AI-enabled products and AI-assisted engineering workflows.Reduced confirmed, exploitable risk across our products, prioritized by reachability, exposure and impact rather than raw CVE counts, and tracked with product-security metrics such as time to remediate confirmed findings and repeat-finding rates. Help define and improve the vulnerability-intake operating model, including appropriate handling of urgent findings.Used AI and automation to speed up triage and remediation, with defined human review gates for decisions that carry risk.You will accomplish these outcomes through the following responsibilities...Own the application security toolchain (SAST, SCA, container and secret scanning, DAST): configuration, custom rules, and a false-positive rate engineers can live with.Build security automation in Python or TypeScript and GitHub Actions: policy-as-code checks, auto-triage and fix pull requests.Run threat models and design reviews for new services and AI features, and review high-risk pull requests.Improve how Security engages across the product lifecycle: get involved early in new products, major changes, AI features and customer deployments, partner with Engineering and FDE teams on designs and fixes, and represent product security in customer security reviews.Reduce engineering friction and help ensure sufficient engineering capacity for timely security remediation.Scope penetration tests, validate their findings and verify the fixes.Evaluate AI security tooling and coach engineers on secure LLM, LLM Gateways, MCP, RAG and agent patterns.Keep SDLC and vulnerability management controls audit-ready for SOC 2, and join the security on-call rotation.Projects you would join:AI runtime security proof of concept for our production LLM featuresAI agents that triage, investigate and remediate vulnerability findings end to endThreat models of core product servicesPenetration test remediation across our productsDependency and container vulnerability burn-down in product infrastructure repositoriesSecurity baseline for our products deployed into customer cloud accountsWhat you bring to Komodo Health (Required):Engineering depth: 6+ years in software or security engineering, 3+ of them in application or product security, shipping production code in Python, TypeScript, Go or Java.GitHub and CI/CD: hands-on GitHub Actions at scale (reusable workflows, OIDC, secrets, self-hosted runners), and a working model of pipeline attacks such as poisoned pipeline execution, dependency confusion and compromised actions, with their defenses (pinning, SBOMs, artifact signing, SLSA).SAST and SCA: ran a scanning program across many repositories, wrote custom rules, and prioritized by reachability and exploitability rather than raw severity.Penetration testing and DAST: hands-on penetration testing of web apps and APIs, authenticated DAST, and the judgment to confirm or dismiss a finding; fluent in the OWASP Top 10 and API Security Top 10.AI security: hands-on securing of LLM applications or agents against prompt injection, data leakage, insecure output handling and excessive agency (OWASP Top 10 for LLM Applications); you use AI coding assistants in your own daily work.Threat modeling: structured threat modeling and secure design review of services and AI features, using methods such as STRIDE and AI-focused frameworks such as MAESTRO.Cloud: hands-on security work in at least one of AWS, GCP or Azure, covering identity and access, network controls, containers and infrastructure as code.Partnership: you have embedded with engineering teams and shipped fixes in their codebases rather than handing over findings. You influence without authority, explain risk in business terms, write clear documentation and own outcomes end to end.Additional skills and experience we’d prioritize (nice to have)...Built or operated AI agents for security work (for example LLM-based triage or automated fix pull requests)Experience with AI runtime protection or LLM gateway productsBug bounty background, published CVEs, talks or open-source security toolsSOC 2 experience with SDLC and vulnerability management controlsDetection engineering for application-layer threats in a SIEMPrevious experience at a healthcare or data platform companyForward deployed or customer-facing work: securing deployments in customer-owned cloud accounts and supporting enterprise customer security reviewsMulti-cloud depth across AWS, GCP and AzureCertifications are a plus, not a substitute for hands-on work: application security certifications such as OSWE or GWAPT, and AWS, GCP or Azure security certifications#LI-RemoteThe pay range for each job posting reflects a minimum and maximum range of annual base pay that we reasonably expect to pay for this position within the US. We carefully consider multiple business-related factors when determining compensation, including job-related skills, work experience, geographic work location, relevant training and certifications, business needs and market demands.The starting annual base pay for this role is listed below. This position may be eligible for performance-based bonuses as determined in the Company’s sole discretion and in accordance with a written agreement or plan. This role may also be eligible for equity awards. In addition, this role is eligible for benefits including, but not limited to, comprehensive health, dental, and vision insurance; flexible time off and holidays; 401(k) with company match; disability insurance and life insurance; and leaves of absence in accordance with applicable state and local laws and regulations and company policy.San Francisco Bay Area and New York City:$200,000 $245,000 USDAll Other US Locations:$174,000 $215,000 USDKomodo's AI StandardAt Komodo, we're not just witnessing the AI revolution – we're leading it. This is a pivotal moment in time, where being first to market with AI transforms industries and sets the bar. We've already established industry leadership in leveraging AI to revolutionize healthcare, and we expect every team member to contribute. AI here isn't optional; it's foundational. We expect you to integrate AI into your daily work – from summarizing documents to automating workflows and uncovering insights. This isn't just about efficiency; it's about making every moment more meaningful, building on trust in AI, and driving our collective success.Join us in shaping the future of healthcare intelligence.Where You’ll WorkKomodo Health has a hybrid work model with hubs in San Francisco, New York City, and Chicago. Roles vary — some can be performed from anywhere in the country, others are scoped to a specific region, and some are based near one of our hubs. For hub-based Dragons, we're building intentional in-office rhythms alongside the flexibility that's core to how we work. Whatever your setup, expectations will always be clear before you join.Equal Opportunity StatementKomodo Health provides equal employment opportunities to all applicants and employees. We prohibit discrimination and harassment of any type with regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state, or local laws.By submitting your application, you acknowledge that you have read and understand Komodo Health’s Privacy Notice for Employees and Contractors.This notice explains how we collect, use, and retain applicant data.