Senior Security Engineer, Product Security

📋 Job Overview

At Komodo Health, our mission is to reduce the global burden of disease. That’s why we built the Healthcare Map — the industry’s largest, most complete, precise view of the U.S. healthcare system — by combining de-identified, real-world patient data with innovative algorithms and decades of clinical experience. The Healthcare Map serves as our foundation for a powerful suite of software applications, helping us answer healthcare’s most complex questions for our partners. Across the healthcare ecosystem, we’re helping our clients unlock critical insights to track detailed patient behaviors and treatment patterns, identify gaps in care, address unmet patient needs, and reduce the global burden of disease.

🏢 About Komodo Health

At Komodo, we're not just witnessing the AI revolution — we're leading it. This is a pivotal moment in time, where being first to market with AI transforms industries and sets the bar. We've already established industry leadership in leveraging AI to revolutionize healthcare, and we expect every team member to contribute. AI here isn't optional; it's foundational. We expect you to integrate AI into your daily work — from summarizing documents to automating workflows and uncovering insights. This isn't just about efficiency; it's about making every moment more meaningful, building on trust in AI, and driving our collective success.

🎯 The Role

The Security team protects Komodo Health's data, platform and people. We run application and cloud security, vulnerability management, detection and response, and our SOC 2 program. We partner with engineering teams so the secure path is also the fastest one. This role sits in Security, works day to day with Product Security, and supports both our Engineering teams and our Forward Deployed Engineering (FDE) team.

This role gives Product Security deep engineering capacity for two groups: the Engineering teams that build our products, and the FDE team that deploys them into customer cloud environments. You will own the security of how Komodo builds, ships and deploys software: GitHub, CI/CD pipelines, SAST, SCA and DAST, and the AI features and coding agents our teams now ship with. Success means accurate findings reach engineers early, remediation scales through automation and secure defaults instead of tickets, AI features launch with guardrails designed in, and product-security metrics show measurable risk reduction.

You join while Komodo is putting LLM features into its products and AI agents into its engineering workflow, so you will help set the patterns everyone else follows. You will write code as much as you review it, and your work will show up in every repository and every release.

✅ Key Responsibilities

• Own the application security toolchain (SAST, SCA, container and secret scanning, DAST): configuration, custom rules, and a false-positive rate engineers can live with.
• Build security automation in Python or TypeScript and GitHub Actions: policy-as-code checks, auto-triage and fix pull requests.
• Run threat models and design reviews for new services and AI features, and review high-risk pull requests.
• Improve how Security engages across the product lifecycle: get involved early in new products, major changes, AI features and customer deployments, partner with Engineering and FDE teams on designs and fixes, and represent product security in customer security reviews.
• Reduce engineering friction and help ensure sufficient engineering capacity for timely security remediation.
• Scope penetration tests, validate their findings and verify the fixes.
• Evaluate AI security tooling and coach engineers on secure LLM, LLM Gateways, MCP, RAG and agent patterns.
• Keep SDLC and vulnerability management controls audit-ready for SOC 2, and join the security on-call rotation.

📌 Required Qualifications

• Engineering depth: 6+ years in software or security engineering, 3+ of them in application or product security, shipping production code in Python, TypeScript, Go or Java.
• GitHub and CI/CD: hands-on GitHub Actions at scale (reusable workflows, OIDC, secrets, self-hosted runners), and a working model of pipeline attacks such as poisoned pipeline execution, dependency confusion and compromised actions, with their defenses (pinning, SBOMs, artifact signing, SLSA).
• SAST and SCA: ran a scanning program across many repositories, wrote custom rules, and prioritized by reachability and exploitability rather than raw severity.
• Penetration testing and DAST: hands-on penetration testing of web apps and APIs, authenticated DAST, and the judgment to confirm or dismiss a finding; fluent in the OWASP Top 10 and API Security Top 10.
• AI security: hands-on securing of LLM applications or agents against prompt injection, data leakage, insecure output handling and excessive agency (OWASP Top 10 for LLM Applications); you use AI coding assistants in your own daily work.
• Threat modeling: structured threat modeling and secure design review of services and AI features, using methods such as STRIDE and AI-focused frameworks such as MAESTRO.
• Cloud: hands-on security work in at least one of AWS, GCP or Azure, covering identity and access, network controls, containers and infrastructure as code.
• Partnership: you have embedded with engineering teams and shipped fixes in their codebases rather than handing over findings. You influence without authority, explain risk in business terms, write clear documentation and own outcomes end to end.

⭐ Desirable Experience

• Built or operated AI agents for security work (for example LLM-based triage or automated fix pull requests)
• Experience with AI runtime protection or LLM gateway products
• Bug bounty background, published CVEs, talks or open-source security tools
• SOC 2 experience with SDLC and vulnerability management controls
• Detection engineering for application-layer threats in a SIEM
• Previous experience at a healthcare or data platform company
• Forward deployed or customer-facing work: securing deployments in customer-owned cloud accounts and supporting enterprise customer security reviews
• Multi-cloud depth across AWS, GCP and Azure
• Certifications are a plus, not a substitute for hands-on work: application security certifications such as OSWE or GWAPT, and AWS, GCP or Azure security certifications

🎁 Benefits

The starting annual base pay for this role is listed below. This position may be eligible for performance-based bonuses as determined in the Company’s sole discretion and in accordance with a written agreement or plan. This role may also be eligible for equity awards. In addition, this role is eligible for benefits including, but not limited to, comprehensive health, dental, and vision insurance; flexible time off and holidays; 401(k) with company match; disability insurance and life insurance; and leaves of absence in accordance with applicable state and local laws and regulations and company policy.

🛂 Visa & Eligibility

Komodo Health provides equal employment opportunities to all applicants and employees. We prohibit discrimination and harassment of any type with regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state, or local laws.