Skip to content

AppSec

Senior Software Engineer (Security Champion), Runtimes

Kong logoKongEUR 77,180–95,340/yrMilan, ItalyFull-timePosted 4w ago
Apply on Kong (shows the role here)Kong as an employer: salaries and roles

The full posting

Are you ready to unlock intelligence?

If you don’t think you meet all of the criteria below but are still interested in the job, please apply. Nobody checks every box - we’re looking for candidates that are particularly strong in a few areas, and have some interest and capabilities in others.

About the Role

At Kong, our API and AI Gateway sits at the center of how Fortune 500 enterprises and AI-native startups secure and govern the flow of intelligence.

Every request into a company's infrastructure goes through the Gateway first. Security isn't a side concern here, it's the top priority: you're guarding the front door.

You'll be securing AI traffic while the playbook is still being written: prompt injection, agentic authorization, MCP. These are problems nobody has fully solved yet.

We're looking for a Software Engineer with a security specialization to join our Runtimes team as a Security Champion: an engineer who writes real code and makes security a built-in part of how we ship.

What You'll Do

  • Run security-focused code audits, threat modeling, and secure design reviews across our AI Gateway and API Gateway capabilities
  • Own vulnerability management end-to-end: triage, reproduction, remediation, verification
  • Partner with AI Gateway engineering on emerging AI/LLM threat patterns (ie: prompt injection, data leakage, model abuse)
  • Coach engineers on secure coding practices, turning security findings into lasting team habits
  • Contribute hands-on to Gateway feature work, with security built-in from day one

What You'll Bring

  • 5+ years building production software, with 2+ years in a dedicated security role (AppSec, vulnerability research, or pentesting);
  • Solid coding skills in a object oriented language (Rust, Java, Python, Go, or similar);
  • Practical threat-modeling experience;
  • Working knowledge of cybersecurity (especially L7 security and authentication);
  • Basic knowledge of AI attack vectors.

Nice-to-have

  • Familiarity with L7 proxies/API gateway architecture (Nginx, OpenResty, Envoy, HAProxy or Kong);
  • Experience with Lua;
  • Open-source contributions;
  • Willingness to learn Rust is important for where our platform is heading: we'll help you get there.

What we offer

  • A permanent contract under the CCNL Commercio (Quadro)
  • Bonus and welfare system
  • Hybrid work from our Milan Hub at Talent Garden Isola, and a seat at the table where security decisions actually shape what millions of API calls run through every day.

#LI-EA1

About Kong

Kong Inc., the AI Connectivity Company, is building the connectivity layer of AI. Trusted by the Fortune 500® and AI-native startups alike, Kong’s unified API and AI platform enables organizations to secure, manage, accelerate, govern, and monetize the flow of intelligence across APIs and AI traffic - on any model, any cloud. For more information, visit www.konghq.com .

Text as Kong published it; last compared with the original on 12 Nov 2026.

Apply on Kong (shows the role here)

The application

Your details, CV and LinkedIn, then 5 questions (1 written).

Keep these to handCVLinkedInGitHub (optional)
  1. 1.
    Other website / linksShort answer · optional
  2. 2.
    Add anything else you would like to share.Written answer · optional
  3. 3.
    Are you legally authorized to work in the country where this position will be worked?Yes or no
  4. 4.
    Do you now, or will you in the future, require sponsorship?Yes or no
  5. 5.
    If so, what type of visa are you currently on and when does it expire?Short answer

Taken from Kong's application form as it stood on 12 Nov 2026.

The employer: Kong

Makes the Kong API gateway and Konnect platform; open security work is an identity staff engineer in Toronto and a runtimes security champion in Milan.

Pay and benefits: Engineering employment; Toronto allows remote work, Milan does not.

Full postings from Kong All Kong openings on the board Kong employer profile

Other security roles worth a look

A few links on CyberJobs.cc are referral links: when one leads to a hire, a sign-up or a purchase (a lab, a course or a tool marked Partner), the company behind it may pay CyberJobs.cc a fee. You pay nothing extra, and it never changes the salary an employer offers you or which roles the board lists. Roles from partners who pay us a fee rank a little higher in this list.

Let security teams come to you

Security teams sometimes ask us directly for someone with a given specialty, clearance or certification. Join the candidate pool once and we put you forward when a brief matches, and only after you say yes. No cost to you.

Create my profile

Hear first when Kong posts a security role

We read Kong's careers system around the clock and send its new security roles in a weekly email, along with comparable openings at other employers. Free; leave whenever you like.