Join Kong as a Senior Security Engineer to secure AI traffic and enhance security practices within the Runtimes team.
Posted by employer 2 days ago
First seen on Joblaze 1 day ago
Last verified on the company career page 5 hours ago
What you'll build
- Run security-focused code audits
- Own vulnerability management end-to-end
- Partner with AI Gateway engineering
- Coach engineers on secure coding practices
- Contribute hands-on to Gateway feature work
Must have
- 3+ years building production software
- 2+ years in a dedicated security role
- Solid coding skills in an object oriented language
- Practical threat-modeling experience
- Working knowledge of cybersecurity
Nice to have
- Familiarity with L7 proxies/API gateway architecture
- Experience with Lua
- Open-source contributions
- Willingness to learn Rust
AI in the day-to-day
Securing AI traffic while addressing emerging AI/LLM threat patterns.
Requirements
- Experience
- 3+ years
Not disclosed in this posting: compensation, visa sponsorship.
Benefits
Joblaze summary
In this role, the Senior Security Engineer focuses on integrating security into the development of Kong's API and AI Gateway, conducting code audits, threat modeling, and secure design reviews. The position requires strong coding skills in languages like Rust, Java, or Python, along with practical experience in cybersecurity and threat modeling. Ideal candidates have over three years of software development experience, including two years in a security-focused role, and are comfortable coaching others on secure coding practices. The team is engaged in addressing emerging security challenges in AI, making this a pivotal role in a company at the forefront of API and AI connectivity.
Joblaze insights
- Listed yesterday — first seen on Joblaze October 15, 2026. Last confirmed on Kong's careers page October 17, 2026.
Quick facts
- Is the Senior Security Engineer (Security Champion), Runtimes role remote?
- It's hybrid — Kong expects some on-site time in Milan, Italy.
- How much experience is required?
- At least 3 years of relevant experience for this Senior Security Engineer (Security Champion), Runtimes role.
- Where is the role based?
- Kong is hiring for this position in Milan, Italy.
- What's the tech stack?
- Joblaze extracted these technologies from the posting: Envoy, Go, Java, Kong, Lua, Nginx.
- What seniority level is this role?
- Kong targets senior candidates for this position.
- Is this full-time or contract?
- Full-time for this Senior Security Engineer (Security Champion), Runtimes role at Kong.
From the original posting
About the Role:
At Kong, our API and AI Gateway sits at the center of how Fortune 500 enterprises and AI-native startups secure and govern the flow of intelligence.
Every request into a company's infrastructure goes through the Gateway first. Security isn't a side concern here, it's the top priority: you're guarding the front door.
You'll be securing AI traffic while the playbook is still being written: prompt injection, agentic authorization, MCP. These are problems nobody has fully solved yet.
We're looking for a Software Engineer with a security specialization to join our Runtimes team as a Security Champion: an engineer who writes real code and makes security a built-in part of how we ship.
What You'll Do:
Run security-focused code audits, threat modeling, and secure design reviews across our AI Gateway and API Gateway capabilities
Own vulnerability management end-to-end: triage, reproduction, remediation, verification
Partner with AI Gateway engineering on emerging AI/LLM threat patterns (ie: prompt injection, data leakage, model abuse)
Coach engineers on secure coding practices, turning security findings into lasting team habits
Contribute hands-on to Gateway feature work, with security built-in from day one
What You'll Bring:
3+ years building production software, with 2+ years in a dedicated security role (AppSec, vulnerability research, or pentesting);
Solid coding skills in a object oriented language (Rust, Java, Python, Go, or similar);
Practical threat-modeling experience;
Working knowledge of cybersecurity (especially L7 security and authentication);
Basic knowledge of AI attack vectors.
Nice-to-have:
Familiarity with L7 proxies/API gateway architecture (Nginx, OpenResty, Envoy, HAProxy or Kong);
Experience with Lua;
Open-source contributions;
Willingness to learn Rust is important for where our platform is heading: we'll help you get there.
What we offer:
A permanent contract under the CCNL Commercio (Quadro)
Bonus and welfare system
Hybrid work from our Milan Hub at Talent Garden Isola, and a seat at the table where security decisions actually shape what millions of API calls run through every day.
#LI-EA1
Standard company text repeated across Kong's postings is omitted here.
Similar positions
Explore more