8 hours ago
Milan, ItalySenior
Responsibilities
- Conduct security-focused code audits, threat modeling, and secure design reviews for AI Gateway and API Gateway capabilities.
- Own vulnerability management end to end, including triage, reproduction, remediation, and verification.
- Partner with AI Gateway engineering on AI and LLM threat patterns such as prompt injection, data leakage, and model abuse.
- Coach engineers on secure coding practices and turn security findings into lasting team habits.
- Contribute hands-on to Gateway feature development with security built in from the start.
Requirements
- Have 3+ years of experience building production software and 2+ years in a dedicated security role such as application security, vulnerability research, or penetration testing.
- Demonstrate solid coding skills in an object-oriented language such as Rust, Java, Python, Go, or a similar language.
- Have practical threat-modeling experience and working knowledge of cybersecurity, especially L7 security and authentication.
- Have basic knowledge of AI attack vectors.
- Familiarity with L7 proxies or API gateway architecture, including Nginx, OpenResty, Envoy, HAProxy, or Kong, is preferred.
- Experience with Lua and open-source contributions are preferred.
- Be willing to learn Rust for the platform’s future direction.
Benefits
- Permanent contract under the CCNL Commercio (Quadro).
- Bonus and welfare system.
- Hybrid work from the Milan Hub at Talent Garden Isola.
- Opportunity to shape security decisions affecting API and AI traffic at scale.
About Kong
Kong builds an open-source and commercial platform for API and AI connectivity, including Kong Gateway, Kong Konnect, and service mesh tools (Kuma/Kong Mesh) to secure, manage, and observe APIs and LLM traffic across clouds. It sells subscriptions and cloud services for API lifecycle management, security, and traffic governance to enterprises and platform teams. Founded in 2017 and headquartered in San Francisco, Kong is privately held.