Role overview

Kong is seeking a Senior Security Engineer to join the Runtimes team as a Security Champion. In this role, you’ll embed security expertise directly into the development of Kong’s API and AI Gateway, a platform that processes requests for Fortune 500 enterprises and AI-native startups. You’ll combine hands-on coding with security leadership, addressing novel threats in AI traffic where best practices are still emerging.

Key responsibilities

Conduct security-focused code audits, threat modeling, and secure design reviews across the AI Gateway and API Gateway products.
Own the full vulnerability management lifecycle, from triage and reproduction through remediation and verification.
Collaborate with the AI Gateway engineering team to identify and address emerging threats specific to AI and large language models, including prompt injection and data leakage risks.
Mentor engineers on secure coding practices, translating security findings into sustainable team habits and standards.
Contribute directly to Gateway feature development, ensuring security considerations are integrated from the initial design phase.

Requirements

At least three years of experience building production software, with a minimum of two years in a dedicated security role such as application security, vulnerability research, or penetration testing.
Strong coding skills in an object-oriented language, with examples including Rust, Java, Python, Go, or similar.
Practical experience with threat modeling and a working knowledge of cybersecurity fundamentals, particularly Layer 7 security and authentication mechanisms.
Basic familiarity with AI attack vectors and emerging threats in the AI landscape.
Experience with Layer 7 proxies or API gateway architecture (such as Nginx, OpenResty, Envoy, HAProxy, or Kong) is advantageous.
Lua experience and open-source contributions are valued; willingness to learn Rust is important for the platform’s technical direction.

What makes this role worth considering

You’ll work in Milan at Kong’s Talent Garden Isola hub on a hybrid basis, with a permanent contract and comprehensive welfare benefits. This position offers rare access to shape how security decisions influence millions of API calls daily, while tackling unsolved problems in AI security alongside a team that values both technical depth and knowledge sharing.