Senior Security Engineer (Security Champion), Runtimes

Kong
Milan, Italy
HybridCareer-pivot friendly

Who this role is best for

Best suited to engineers with security specialization and experience in AI threat modeling working in API and AI gateway environments.

Best fit for

  • Engineers with a security background and interest in AI threat modeling
    — “Partner with AI Gateway engineering on emerging AI/LLM threat patterns”
  • Candidates who have contributed to or worked with API gateway architecture
    — “Familiarity with L7 proxies/API gateway architecture (Nginx, OpenResty, Envoy, HAProxy or Kong)”

Things to consider

  • The role requires a strong commitment to hands-on coding and security integration
    — “Contribute hands-on to Gateway feature work, with security built-in from day one”
  • Willingness to learn Rust is a key future requirement for the platform
    — “Willingness to learn Rust is important for where our platform is heading”

How to stand out

  • Highlight experience in secure design reviews and vulnerability management
    — “Own vulnerability management end-to-end: triage, reproduction, remediation, verification”
  • Emphasize practical threat modeling and secure coding practices in your resume
    — “Coach engineers on secure coding practices, turning security findings into lasting team habits”
  • Showcase your coding skills in object-oriented languages like Python or Java
    — “Solid coding skills in an object oriented language (Rust, Java, Python, Go, or similar)”
  • Demonstrate knowledge of AI-specific attack vectors in your application materials
    — “Basic knowledge of AI attack vectors”
Pace · Fast PacedCollaboration · HighAutonomy · MediumDecision Impact · Team

Derived from job-description analysis by Serendipath's career intelligence engine.

What success looks like

  • securing AI traffic
  • partnering with engineering on emerging AI/LLM threat patterns
  • coaching engineers on secure coding
Typical background
software engineeringapplication securityvulnerability research

Skills & requirements

Required

Software EngineeringSecurity AuditingThreat ModelingVulnerability ManagementSecure Coding Practices

Preferred

AI Security KnowledgeL7 Proxies/api Gateway Architecture

Stack & domain

RustJavaPythonGoLuaSecurityAI

About the role

Original posting from Kong via Ashby

Are you ready to unlock intelligence?

If you don’t think you meet all of the criteria below but are still interested in the job, please apply. Nobody checks every box - we’re looking for candidates that are particularly strong in a few areas, and have some interest and capabilities in others.

About the Role:

At Kong, our API and AI Gateway sits at the center of how Fortune 500 enterprises and AI-native startups secure and govern the flow of intelligence.

Every request into a company's infrastructure goes through the Gateway first. Security isn't a side concern here, it's the top priority: you're guarding the front door.

You'll be securing AI traffic while the playbook is still being written: prompt injection, agentic authorization, MCP. These are problems nobody has fully solved yet.

We're looking for a Software Engineer with a security specialization to join our Runtimes team as a Security Champion: an engineer who writes real code and makes security a built-in part of how we ship.

What You'll Do:

  • Run security-focused code audits, threat modeling, and secure design reviews across our AI Gateway and API Gateway capabilities
  • Own vulnerability management end-to-end: triage, reproduction, remediation, verification
  • Partner with AI Gateway engineering on emerging AI/LLM threat patterns (ie: prompt injection, data leakage, model abuse)
  • Coach engineers on secure coding practices, turning security findings into lasting team habits
  • Contribute hands-on to Gateway feature work, with security built-in from day one

What You'll Bring:

  • 3+ years building production software, with 2+ years in a dedicated security role (AppSec, vulnerability research, or pentesting);
  • Solid coding skills in a object oriented language (Rust, Java, Python, Go, or similar);
  • Practical threat-modeling experience;
  • Working knowledge of cybersecurity (especially L7 security and authentication);
  • Basic knowledge of AI attack vectors.

Nice-to-have:

  • Familiarity with L7 proxies/API gateway architecture (Nginx, OpenResty, Envoy, HAProxy or Kong);
  • Experience with Lua;
  • Open-source contributions;
  • Willingness to learn Rust is important for where our platform is heading: we'll help you get there.

What we offer:

  • A permanent contract under the CCNL Commercio (Quadro)
  • Bonus and welfare system
  • Hybrid work from our Milan Hub at Talent Garden Isola, and a seat at the table where security decisions actually shape what millions of API calls run through every day.

#LI-EA1

About Kong:

Kong Inc., the AI Connectivity Company, is building the connectivity layer of AI. Trusted by the Fortune 500® and AI-native startups alike, Kong’s unified API and AI platform enables organizations to secure, manage, accelerate, govern, and monetize the flow of intelligence across APIs and AI traffic — on any model, any cloud. For more information, visit www.konghq.com http://www.konghq.com.

Source: Kong careers (Ashby)

Similar roles