Senior Security Engineer, Product Security

We Breathe Life Into Data

At Komodo Health, our mission is to reduce the global burden of disease. And we believe that smarter use of data is essential to this mission. That’s why we built the Healthcare Map — the industry’s largest, most complete, precise view of the U.S. healthcare system — by combining de-identified, real-world patient data with innovative algorithms and decades of clinical experience. The Healthcare Map serves as our foundation for a powerful suite of software applications, helping us answer healthcare’s most complex questions for our partners. Across the healthcare ecosystem, we’re helping our clients unlock critical insights to track detailed patient behaviors and treatment patterns, identify gaps in care, address unmet patient needs, and reduce the global burden of disease.

As we pursue these goals, it remains essential to us that we stay grounded in our values: be awesome, seek growth, deliver “wow,” and enjoy the ride. At Komodo, you will be joining a team of ambitious, supportive Dragons with diverse backgrounds but a shared passion to deliver on our mission to reduce the burden of disease — and enjoy the journey along the way.

The Opportunity at Komodo Health

The Security team protects Komodo Health's data, platform and people. We run application and cloud security, vulnerability management, detection and response, and our SOC 2 program. We partner with engineering teams so the secure path is also the fastest one. This role sits in Security, works day to day with Product Security, and supports both our Engineering teams and our Forward Deployed Engineering (FDE) team.

This role gives Product Security deep engineering capacity for two groups: the Engineering teams that build our products, and the FDE team that deploys them into customer cloud environments. You will own the security of how Komodo builds, ships and deploys software: GitHub, CI/CD pipelines, SAST, SCA and DAST, and the AI features and coding agents our teams now ship with. Success means accurate findings reach engineers early, remediation scales through automation and secure defaults instead of tickets, AI features launch with guardrails designed in, and product-security metrics show measurable risk reduction.

You join while Komodo is putting LLM features into its products and AI agents into its engineering workflow, so you will help set the patterns everyone else follows. You will write code as much as you review it, and your work will show up in every repository and every release.

Looking back on your first 12 months at Komodo Health, you will have…

Established a trusted, scalable security-testing path across Komodo’s products and repositories, enabling engineers to identify and address security issues earlier.

Strengthened Komodo’s software supply chain and delivery practices through secure defaults, appropriate access controls, and resilient deployment patterns.

Established practical security patterns and guardrails for AI-enabled products and AI-assisted engineering workflows.

Reduced confirmed, exploitable risk across our products, prioritized by reachability, exposure and impact rather than raw CVE counts, and tracked with product-security metrics such as time to remediate confirmed findings and repeat-finding rates. Help define and improve the vulnerability-intake operating model, including appropriate handling of urgent findings.

Used AI and automation to speed up triage and remediation, with defined human review gates for decisions that carry risk.

You will accomplish these outcomes through the following responsibilities…

Own the application security toolchain (SAST, SCA, container and secret scanning, DAST): configuration, custom rules, and a false-positive rate engineers can live with.

Build security automation in Python or TypeScript and GitHub Actions: policy-as-code checks, auto-triage and fix pull requests.

Run threat models and design reviews for new services and AI features, and review high-risk pull requests.

Improve how Security engages across the product lifecycle: get involved early in new products, major changes, AI features and customer deployments, partner with Engineering and FDE teams on designs and fixes, and represent product security in customer security reviews.

Reduce engineering friction and help ensure sufficient engineering capacity for timely security remediation.

Scope penetration tests, validate their findings and verify the fixes.

Evaluate AI security tooling and coach engineers on secure LLM, LLM Gateways, MCP, RAG and agent patterns.

Keep SDLC and vulnerability management controls audit-ready for SOC 2, and join the security on-call rotation.

Projects you would join:

AI runtime security proof of concept for our production LLM features

AI agents that triage, investigate and remediate vulnerability findings end to end

Threat models of core product services

Penetration test remediation across our products

Dependency and container vulnerability burn-down in product infrastructure repositories

Security baseline for our products deployed into customer cloud accounts

What you bring to Komodo Health (Required):

Engineering depth: 6+ years in software or security engineering, 3+ of them in application or product security, shipping production code in Python, TypeScript, Go or Java.

GitHub and CI/CD: hands-on GitHub Actions at scale (reusable workflows, OIDC, secrets, self-hosted runners), and a working model of pipeline attacks such as poisoned pipeline execution, dependency confusion and compromised actions, with their defenses (pinning, SBOMs, artifact signing, SLSA).

SAST and SCA: ran a scanning program across many repositories, wrote custom rules, and prioritized by reachability and exploitability rather than raw severity.

Penetration testing and DAST: hands-on penetration testing of web apps and APIs, authenticated DAST, and the judgment to confirm or dismiss a finding; fluent in the OWASP Top 10 and API Security Top 10.

AI security: hands-on securing of LLM applications or agents against prompt injection, data leakage, insecure output handling and excessive agency (OWASP Top 10 for LLM Applications); you use AI coding assistants in your own daily work.

Threat modeling: structured threat modeling and secure design review of services and AI features, using methods such as STRIDE and AI-focused frameworks such as MAESTRO.

Cloud: hands-on security work in at least one of AWS, GCP or Azure, covering identity and access, network controls, containers and infrastructure as code.

Partnership: you have embedded with engineering teams and shipped fixes in their codebases rather than handing over findings. You influence without authority, explain risk in business terms, write clear documentation and own outcomes end to end.

Additional skills and experience we’d prioritize (nice to have)…

Built or operated AI agents for security work (for example LLM-based triage or automated fix pull requests)

Experience with AI runtime protection or LLM gateway products

Bug bounty background, published CVEs, talks or open-source security tools

SOC 2 experience with SDLC and vulnerability management controls

Detection engineering for application-layer threats in a SIEM

Previous experience at a healthcare or data platform company

Forward deployed or customer-facing work: securing deployments in customer-owned cloud accounts and supporting enterprise customer security reviews

Multi-cloud depth across AWS, GCP and Azure

Certifications are a plus, not a substitute for hands-on work: application security certifications such as OSWE or GWAPT, and AWS, GCP or Azure security certifications

#LI-Remote

The pay range for each job posting reflects a minimum and maximum range of annual base pay that we reasonably expect to pay for this position within the US. We carefully consider multiple business-related factors when determining compensation,