Senior Security Engineer, Product Security

At Komodo Health, our mission is to reduce the global burden of disease. And we believe that smarter use of data is essential to this mission. That’s why we built the Healthcare Map — the industry’s largest, most complete, precise view of the U.S. healthcare system — by combining de-identified, real-world patient data with innovative algorithms and decades of clinical experience. The Healthcare Map serves as our foundation for a powerful suite of software applications, helping us answer healthcare’s most complex questions for our partners. Across the healthcare ecosystem, we’re helping our clients unlock critical insights to track detailed patient behaviors and treatment patterns, identify gaps in care, address unmet patient needs, and reduce the global burden of disease. 

As we pursue these goals, it remains essential to us that we stay grounded in our values: be awesome, seek growth, deliver “wow,” and enjoy the ride. At Komodo, you will be joining a team of ambitious, supportive Dragons with diverse backgrounds but a shared passion to deliver on our mission to reduce the burden of disease — and enjoy the journey along the way.

The Security team protects Komodo Health's data, platform and people. We run application and cloud security, vulnerability management, detection and response, and our SOC 2 program. We partner with engineering teams so the secure path is also the fastest one. This role sits in Security, works day to day with Product Security, and supports both our Engineering teams and our Forward Deployed Engineering (FDE) team.

This role gives Product Security deep engineering capacity for two groups: the Engineering teams that build our products, and the FDE team that deploys them into customer cloud environments. You will own the security of how Komodo builds, ships and deploys software: GitHub, CI/CD pipelines, SAST, SCA and DAST, and the AI features and coding agents our teams now ship with. Success means accurate findings reach engineers early, remediation scales through automation and secure defaults instead of tickets, AI features launch with guardrails designed in, and product-security metrics show measurable risk reduction.

You join while Komodo is putting LLM features into its products and AI agents into its engineering workflow, so you will help set the patterns everyone else follows. You will write code as much as you review it, and your work will show up in every repository and every release.

• Established a trusted, scalable security-testing path across Komodo’s products and repositories, enabling engineers to identify and address security issues earlier.
• Strengthened Komodo’s software supply chain and delivery practices through secure defaults, appropriate access controls, and resilient deployment patterns.
• Established practical security patterns and guardrails for AI-enabled products and AI-assisted engineering workflows.
• Reduced confirmed, exploitable risk across our products, prioritized by reachability, exposure and impact rather than raw CVE counts, and tracked with product-security metrics such as time to remediate confirmed findings and repeat-finding rates. Help define and improve the vulnerability-intake operating model, including appropriate handling of urgent findings.
• Used AI and automation to speed up triage and remediation, with defined human review gates for decisions that carry risk.

• →Own the application security toolchain (SAST, SCA, container and secret scanning, DAST): configuration, custom rules, and a false-positive rate engineers can live with.
• →Build security automation in Python or TypeScript and GitHub Actions: policy-as-code checks, auto-triage and fix pull requests.
• →Run threat models and design reviews for new services and AI features, and review high-risk pull requests.
• →Improve how Security engages across the product lifecycle: get involved early in new products, major changes, AI features and customer deployments, partner with Engineering and FDE teams on designs and fixes, and represent product security in customer security reviews. 
• →Reduce engineering friction and help ensure sufficient engineering capacity for timely security remediation.
• →Scope penetration tests, validate their findings and verify the fixes.
• →Evaluate AI security tooling and coach engineers on secure LLM, LLM Gateways, MCP, RAG and agent patterns.
• →Keep SDLC and vulnerability management controls audit-ready for SOC 2, and join the security on-call rotation.

• →Engineering depth: 6+ years in software or security engineering, 3+ of them in application or product security, shipping production code in Python, TypeScript, Go or Java.
• →GitHub and CI/CD: hands-on GitHub Actions at scale (reusable workflows, OIDC, secrets, self-hosted runners), and a working model of pipeline attacks such as poisoned pipeline execution, dependency confusion and compromised actions, with their defenses (pinning, SBOMs, artifact signing, SLSA).
• →SAST and SCA: ran a scanning program across many repositories, wrote custom rules, and prioritized by reachability and exploitability rather than raw severity.
• →Penetration testing and DAST: hands-on penetration testing of web apps and APIs, authenticated DAST, and the judgment to confirm or dismiss a finding; fluent in the OWASP Top 10 and API Security Top 10.
• →AI security: hands-on securing of LLM applications or agents against prompt injection, data leakage, insecure output handling and excessive agency (OWASP Top 10 for LLM Applications); you use AI coding assistants in your own daily work.
• →Threat modeling: structured threat modeling and secure design review of services and AI features, using methods such as STRIDE and AI-focused frameworks such as MAESTRO.
• →Cloud: hands-on security work in at least one of AWS, GCP or Azure, covering identity and access, network controls, containers and infrastructure as code.
• →Partnership: you have embedded with engineering teams and shipped fixes in their codebases rather than handing over findings. You influence without authority, explain risk in business terms, write clear documentation and own outcomes end to end.

• AI runtime security proof of concept for our production LLM features
• AI agents that triage, investigate and remediate vulnerability findings end to end
• Threat models of core product services
• Penetration test remediation across our products
• Dependency and container vulnerability burn-down in product infrastructure repositories
• Security baseline for our products deployed into customer cloud accounts

• Built or operated AI agents for security work (for example LLM-based triage or automated fix pull requests)
• Experience with AI runtime protection or LLM gateway products
• Bug bounty background, published CVEs, talks or open-source security tools
• SOC 2 experience with SDLC and vulnerability management controls
• Detection engineering for application-layer threats in a SIEM
• Previous experience at a healthcare or data platform company
• Forward deployed or customer-facing work: securing deployments in customer-owned cloud accounts and supporting enterprise customer security reviews
• Multi-cloud depth across AWS, GCP and Azure
• Certifications are a plus, not a substitute for hands-on work: application security certifications such as OSWE or GWAPT, and AWS, GCP or Azure security certifications

#LI-Remote

At Komodo, we're not just witnessing the AI revolution – we're leading it. This is a pivotal moment in time, where being first to market with AI transforms industries and sets the bar. We've already established industry leadership in leveraging AI to revolutionize healthcare, and we expect every team member to contribute. AI here isn't optional; it's foundational. We expect you to integrate AI into your daily work – from summarizing documents to automating workflows and uncovering insights. This isn't just about efficiency; it's about making every moment more meaningful, building on trust in AI, and driving our collective success.

Komodo Health has a hybrid work model with hubs in San Francisco, New York City, and Chicago. Roles vary — some can be performed from anywhere in the country, others are scoped to a specific region, and some are based near one of our hubs. For hub-based Dragons, we're building intentional in-office rhythms alongside the flexibility that's core to how we work. Whatever your setup, expectations will always be clear before you join.

Komodo Health provides equal employment opportunities to all applicants and employees. We prohibit discrimination and harassment of any type with regard to race, color, religion, age, sex, national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by federal, state, or local laws. 

By submitting your application, you acknowledge that you have read and understand Komodo Health’s Privacy Notice for Employees and Contractors.

This notice explains how we collect, use, and retain applicant data.