Senior Security Engineer (Security Champion), Runtimes

pbAre you ready to unlock intelligence? /b /p /brpIf you don’t think you meet all of the criteria below but are still interested in the job, please apply. Nobody checks every box - we’re looking for candidates that are particularly strong in a few areas, and have some interest and capabilities in others. /p /brh3About the Role /h3 /brpAt Kong, our API and AI Gateway sits at the center of how Fortune 500 enterprises and AI-native startups secure and govern the flow of intelligence. /p /brpEvery request into a company's infrastructure goes through the Gateway first. Security isn't a side concern here, it's the top priority: you're guarding the front door. /p /brpYou’ll be securing AI traffic while the playbook is still being written: prompt injection, agentic authorization, MCP. These are problems nobody has fully solved yet. /p /brpWe’re looking for a Software Engineer with a security specialization to join our Runtimes team as a Security Champion: an engineer who writes real code and makes security a built-in part of how we ship. /p /brh3What You’ll Do /h3 /brul /brlipRun security-focused code audits, threat modeling, and secure design reviews across our AI Gateway and API Gateway capabilities /p /li /brlipOwn vulnerability management end-to-end: triage, reproduction, remediation, verification /p /li /brlipPartner with AI Gateway engineering on emerging AI/LLM threat patterns (ie: prompt injection, data leakage, model abuse) /p /li /brlipCoach engineers on secure coding practices, turning security findings into lasting team habits /p /li /brlipContribute hands-on to Gateway feature work, with security built-in from day one /p /li /br /ul /brh3What You’ll Bring /h3 /brul /brlip3+ years building production software, with 2+ years in a dedicated security role (AppSec, vulnerability research, or pentesting); /p /li /brlipSolid coding skills in a object oriented language (Rust, Java, Python, Go, or similar); /p /li /brlipPractical threat-modeling experience; /p /li /brlipWorking knowledge of cybersecurity (especially L7 security and authentication); /p /li /brlipBasic knowledge of AI attack vectors. /p /li /br /ul /brh3Nice-to-have /h3 /brul /brlipFamiliarity with L7 proxies/API gateway architecture (Nginx, OpenResty, Envoy, HAProxy or Kong); /p /li /brlipExperience with Lua; /p /li /brlipOpen-source contributions; /p /li /brlipWillingness to learn Rust is important for where our platform is heading: we’ll help you get there. /p /li /br /ul /brh3What we offer /h3 /brul /brlipA permanent contract under the CCNL Commercio (Quadro) /p /li /brlipBonus and welfare system /p /li /brlipHybrid work from our Milan Hub at Talent Garden Isola, and a seat at the table where security decisions actually shape what millions of API calls run through every day. /p /li /br /ul /brp#LI-EA1 /p /brh3About Kong /h3 /brpKong Inc., the AI Connectivity Company, is building the connectivity layer of AI. Trusted by the Fortune 500 and AI-native startups alike, Kong’s unified API and AI platform enables organizations to secure, manage, accelerate, govern, and monetize the flow of intelligence across APIs and AI traffic - on any model, any cloud. For more information, visit /p #J-18808-Ljbffr