Senior Security Engineer Customer Engineering

Harness is the AI Software Delivery Platform company led by technologist and entrepreneur Jyoti Bansal (founder of AppDynamics acquired by Cisco for $3.7B). Harness has raised approximately $570M in funding and is valued at $5.5B backed by leading investors including Goldman Sachs Menlo Ventures IVP Unusual Ventures Citi Ventures and more. As AI accelerates code creation the real bottleneck has shifted to everything after the code testing deployments application security reliability compliance and cost optimization. Harness brings AI and automation to this outer loop helping teams ship software faster while maintaining security and governance throughout the entire software delivery lifecycle.

Powered by Harness AI and the Software Delivery Knowledge Graph the Harness Platform applies deep context and intelligent automation across the software delivery lifecycle with governance and policy-driven controls embedded throughout the platform.

Over the past year Harness powered over 185M deployments 82M builds 18T flag evaluations 8M security scans 9.1B optimized tests 3T protected API calls and helped manage $2.8B in cloud spend enabling customers like United Airlines Morningstar and Choice Hotels to accelerate releases by up to 75% reduce cloud costs by up to 60% and achieve 10x DevOps efficiency.

With a global team across 26 offices and 27 countries Harness is shaping the future of AI software delivery and were looking for exceptional talent to help us move even faster.

Were looking for a Senior Security Engineer to sit at the intersection of our Security Research Engineering team and our customers worldwide. This is a deeply technical hands-on detection-focused role for someone who understands how attacks against APIs and AI systems actually work and can prove in real customer traffic whether a detection is firing correctly.

This is a high-impact role. The value customers realize from the entire platform depends on the outcomes this team produces: whether our detections fire correctly whether the threats that matter get surfaced and whether customers trust what we tell them. Youll be the technical authority who validates the detections our researchers build (ModSecurity/WAF rules API security signatures AI security detections OWASP Top 10 / API Top 10 / LLM Top 10 coverage) separates true positives from noise hunts across global customer environments for business logic abuse and fraud and closes the loop back to Research and Product to sharpen detection efficacy.

Youll bring a deep understanding of the security landscape the threat models attacker techniques and rapidly evolving AI security frontier and youll express that understanding through code: scripting automating threat hunts and using AI itself as a force multiplier in your investigations.

Day to day youll work hand in hand with customers own security teams to operationalize the Traceable by Harness Protection module and then stay engaged as an extended SOC and red team continuously improving their security posture rather than handing off at go-live.

• Operationalize the Protection module. Work directly with customers security teams to stand up and tune the Traceable by Harness Protection module in their environment from initial rollout through steady-state enforcement.
• Be their extended SOC and red team. Engage continuously not as a one-off deployment acting as an extension of the customers SOC to monitor and hunt and as a red team to probe their defenses steadily improving their overall security posture.
• Evaluate detections built by Security Research Engineering. Review and pressure-test ModSecurity (ModSec) rulesets API security detections AI Security detections and OWASP Top 10 / OWASP API Top 10 / OWASP LLM Top 10 coverage for accuracy coverage gaps and false-positive rates before and after they reach customers.
• Validate true positives in production traffic. Partner directly with customer security teams to triage platform alerts confirm genuine true positives distinguish them from false positives and benign anomalies and document the reasoning behind each verdict.
• Automate the hunt. Build scripts tooling and automated workflows increasingly AI-assisted that scale threat hunting across many customers at once rather than investigating one alert at a time by hand.
• Run threat hunting engagements globally. Proactively hunt across the API traffic of Harness customers worldwide for business logic abuse (BOLA/BFLA parameter tampering workflow abuse) account takeover credential stuffing scraping carding and fraud patterns that signature-based detection alone wont catch.
• Black-box test the platform and customer APIs. Attack detections and API endpoints the way a real adversary would validating coverage finding blind spots and generating the adversarial traffic needed to confirm detections actually fire.
• Own the detection feedback loop. Turn field findings into concrete prioritized input for Security Research Engineering and Product new rule ideas tuning recommendations catalog/detection integration gaps and coverage improvements.
• Reproduce and investigate incidents. Lead deep-dive investigations into anomalous API behavior trace root cause (including upstream CDN/WAF/gateway layers) and produce clear RCA documentation and findings for both technical and executive audiences.
• Weed out false positives and report on what matters (critical). Aggressively filter noise so customers arent chasing false alarms and deliver clear reports that surface genuine threat insights helping customer teams focus their limited attention on the true incidents that actually require action. This signal-over-noise discipline is central to the value customers get from the platform.
• Reduce customer noise at the source. Tune detections to each customers API catalog business context and legitimate integration patterns so false positives are suppressed before they ever reach an analyst.
• Be a trusted technical advisor. Translate detection logic and threat findings into language customer security leaders can act on and help them mature their API and AI security posture.

Required

• 46 years in security engineering detection engineering threat hunting penetration testing incident response or a closely related discipline.
• A deep current understanding of the security landscape threat models attacker techniques and how attacks against APIs and AI systems actually play out.
• Ability to code and automate. You write your own tooling to scale threat hunting this is not a point-and-click role.
• Ability to use AI for threat hunting. You actively leverage LLMs and AI-assisted workflows to accelerate investigation triage and hunt automation.
• Black-box penetration testing ability you can attack an API or a detection with no prior knowledge and reason about what an adversary would do.
• Comfort working directly with enterprise customers globally you can lead a technical conversation defend a verdict and write findings that stand up to scrutiny.

This is a core technical role. We expect real depth not surface familiarity across most of the following:

• Security frameworks & threat models: OWASP Top 10 OWASP API Security Top 10 and OWASP LLM (GenAI) Top 10; MITRE ATT&CK and MITRE ATLAS for AI/ML threats.
• API security: REST GraphQL and gRPC; authentication and authorization flows (OAuth 2.0 OIDC JWT session handling); and the full range of API attack techniques (BOLA/BFLA mass assignment injection SSRF rate-limit and workflow abuse).
• AI / LLM security: prompt injection sensitive-information disclosure improper output handling excessive agency and abuse of AI-driven or agentic API endpoints and how to detect them.
• Detection & WAF engineering: hands-on with WAF / ModSecurity rule logic reading writing tuning and reasoning about false-positive / false-negative tradeoffs.
• Offensive testing & tooling: black-box testing of APIs and detections using tools such as Burp Suite Postman and OWASP ZAP; generating adversarial traffic to confirm detections fire.
• Scripting & automation: Python (or equivalent) to build investigation tooling and automated increasingly AI-assisted hunt workflows; comfort querying large volumes of traffic and telemetry.
• Threat hunting & fraud analysis: distinguishing business logic abuse and fraud from legitimate traffic account takeover credential stuffing scraping carding and payment fraud.

Nice to Have

• Familiarity with CDN gateway and upstream traffic architectures (Akamai Cloudflare and similar) and how they interact with detection at the edge.
• Prior experience in a customer-facing security engineering SOC or professional services role.
• Certifications (a plus not required). Because this role centers on API and AI security the most relevant credentials are:
• API security: Certified API Pentester (C-APIPen) APIsec University ASCP or PortSwigger Burp Suite Certified Practitioner (BSCP).
• AI / LLM security: a hands-on AI security certification such as CAISP (Certified AI Security Professional) or equivalent.
• Offensive / web depth: OSWE GWAPT or OSCP.
• Note: AI-security certifications are still maturing so demonstrated hands-on ability weighs more heavily than any specific badge.

• Accelerating Our Mission to Bring AI to Everything After Code
• Goldman Sachs leads investment in software delivery startup Harness at $5.5 billion valuation
• How Harness runs 16 startups within a startup at scale Jyoti Bansal
• Harness Research Shows AI Visibility Crisis Fueling Security Nightmare
• Harness has been named to the Inc. Power Partner list for software delivery success

All qualified applicants will receive consideration for employment without regard to race color religion sex or national origin.

At Harness we care about your privacy and are committed to protecting your personal data. For additional information on this topic you can visit our privacy Portal: on Fraudulent Recruiting/Offers

We have become aware that there may be fraudulent recruiting attempts being made by people posing as representatives of Harness. These scams may involve fake job postings unsolicited emails or messages claiming to be from our recruiters or hiring managers.

Please note we do not ask for sensitive or financial information via chat text or social media and any email communications will come from the domain @. Additionally Harness will never ask for any payment fee to be paid or purchases to be made by a job applicant. All applicants are encouraged to apply directly to our open jobs via our website. Interviews are generally conducted via Zoom video conference unless the candidate requests other accommodations.

If you believe that you have been the target of an interview/offer scam by someone posing as a representative of Harness please do not provide any personal or financial information and contact us immediately at. You can also find additional information about this type of scam and report any fraudulent employment offers via the Federal Trade Commissions website ( or you can contact your local law enforcement agency.