Senior Security Engineer - Customer Engineering

The Role

We're looking for a Senior Security Engineer to sit at the intersection of our Security Research Engineering team and our customers worldwide. This is a deeply technical, hands-on, detection-focused role for someone who understands how attacks against APIs and AI systems actually work — and can prove, in real customer traffic, whether a detection is firing correctly.

This is a high-impact role. The value customers realize from the entire platform depends on the outcomes this team produces: whether our detections fire correctly, whether the threats that matter get surfaced, and whether customers trust what we tell them. You'll be the technical authority who validates the detections our researchers build (ModSecurity/WAF rules, API security signatures, AI security detections, OWASP Top 10 / API Top 10 / LLM Top 10 coverage), separates true positives from noise, hunts across global customer environments for business logic abuse and fraud, and closes the loop back to Research and Product to sharpen detection efficacy.

You'll bring a deep understanding of the security landscape — the threat models, attacker techniques, and rapidly evolving AI security frontier — and you'll express that understanding through code: scripting, automating threat hunts, and using AI itself as a force multiplier in your investigations.

Day to day, you'll work hand in hand with customers' own security teams to operationalize the Traceable by Harness Protection module and then stay engaged as an extended SOC and red team — continuously improving their security posture rather than handing off at go-live.

What You'll Do

• Operationalize the Protection module. Work directly with customers' security teams to stand up and tune the Traceable by Harness Protection module in their environment, from initial rollout through steady-state enforcement.
• Be their extended SOC and red team. Engage continuously — not as a one-off deployment — acting as an extension of the customer's SOC to monitor and hunt, and as a red team to probe their defenses, steadily improving their overall security posture.
• Evaluate detections built by Security Research Engineering. Review and pressure-test ModSecurity (ModSec) rulesets, API security detections, AI Security detections, and OWASP Top 10 / OWASP API Top 10 / OWASP LLM Top 10 coverage for accuracy, coverage gaps, and false-positive rates before and after they reach customers.
• Validate true positives in production traffic. Partner directly with customer security teams to triage platform alerts, confirm genuine true positives, distinguish them from false positives and benign anomalies, and document the reasoning behind each verdict.
• Automate the hunt. Build scripts, tooling, and automated workflows — increasingly AI-assisted — that scale threat hunting across many customers at once, rather than investigating one alert at a time by hand.
• Run threat hunting engagements globally. Proactively hunt across the API traffic of Harness customers worldwide for business logic abuse (BOLA/BFLA, parameter tampering, workflow abuse), account takeover, credential stuffing, scraping, carding, and fraud patterns that signature-based detection alone won't catch.
• Black-box test the platform and customer APIs. Attack detections and API endpoints the way a real adversary would — validating coverage, finding blind spots, and generating the adversarial traffic needed to confirm detections actually fire.
• Own the detection feedback loop. Turn field findings into concrete, prioritized input for Security Research Engineering and Product — new rule ideas, tuning recommendations, catalog/detection integration gaps, and coverage improvements.
• Reproduce and investigate incidents. Lead deep-dive investigations into anomalous API behavior, trace root cause (including upstream CDN/WAF/gateway layers), and produce clear RCA documentation and findings for both technical and executive audiences.
• Weed out false positives and report on what matters (critical). Aggressively filter noise so customers aren't chasing false alarms, and deliver clear reports that surface genuine threat insights — helping customer teams focus their limited attention on the true incidents that actually require action. This signal-over-noise discipline is central to the value customers get from the platform.
• Reduce customer noise at the source. Tune detections to each customer's API catalog, business context, and legitimate integration patterns so false positives are suppressed before they ever reach an analyst.
• Be a trusted technical advisor. Translate detection logic and threat findings into language customer security leaders can act on, and help them mature their API and AI security posture.

What You Bring

Required

• 4–6 years in security engineering, detection engineering, threat hunting, penetration testing, incident response, or a closely related discipline.
• A deep, current understanding of the security landscape — threat models, attacker techniques, and how attacks against APIs and AI systems actually play out.
• Ability to code and automate. You write your own tooling to scale threat hunting — this is not a point-and-click role.
• Ability to use AI for threat hunting. You actively leverage LLMs and AI-assisted workflows to accelerate investigation, triage, and hunt automation.
• Black-box penetration testing ability — you can attack an API or a detection with no prior knowledge and reason about what an adversary would do.
• Comfort working directly with enterprise customers globally — you can lead a technical conversation, defend a verdict, and write findings that stand up to scrutiny.

Core Technical Requirements

This is a core technical role. We expect real depth — not surface familiarity — across most of the following:

• Security frameworks & threat models: OWASP Top 10, OWASP API Security Top 10, and OWASP LLM (GenAI) Top 10; MITRE ATT&CK, and MITRE ATLAS for AI/ML threats.
• API security: REST, GraphQL, and gRPC; authentication and authorization flows (OAuth 2.0, OIDC, JWT, session handling); and the full range of API attack techniques (BOLA/BFLA, mass assignment, injection, SSRF, rate-limit and workflow abuse).
• AI / LLM security: prompt injection, sensitive-information disclosure, improper output handling, excessive agency, and abuse of AI-driven or agentic API endpoints — and how to detect them.
• Detection & WAF engineering: hands-on with WAF / ModSecurity rule logic — reading, writing, tuning, and reasoning about false-positive / false-negative tradeoffs.
• Offensive testing & tooling: black-box testing of APIs and detections using tools such as Burp Suite, Postman, and OWASP ZAP; generating adversarial traffic to confirm detections fire.
• Scripting & automation: Python (or equivalent) to build investigation tooling and automated, increasingly AI-assisted hunt workflows; comfort querying large volumes of traffic and telemetry.
• Threat hunting & fraud analysis: distinguishing business logic abuse and fraud from legitimate traffic — account takeover, credential stuffing, scraping, carding, and payment fraud.

Nice to Have

• Familiarity with CDN, gateway, and upstream traffic architectures (Akamai, Cloudflare, and similar) and how they interact with detection at the edge.
• Prior experience in a customer-facing security engineering, SOC, or professional services role.
• Certifications (a plus, not required). Because this role centers on API and AI security, the most relevant credentials are:
• API security: Certified API Pentester (C-APIPen), APIsec University ASCP, or PortSwigger Burp Suite Certified Practitioner (BSCP).
• AI / LLM security: a hands-on AI security certification such as CAISP (Certified AI Security Professional) or equivalent.
• Offensive / web depth: OSWE, GWAPT, or OSCP.
• Note: AI-security certifications are still maturing, so demonstrated hands-on ability weighs more heavily than any specific badge.