Senior Security Engineer - Customer Engineering

We're looking for a Senior Security Engineer to sit at the intersection of our Security Research Engineering team and our customers worldwide. This is a deeply technical, hands-on, detection-focused role for someone who understands how attacks against APIs and AI systems actually work — and can prove, in real customer traffic, whether a detection is firing correctly.

This is a high-impact role. The value customers realize from the entire platform depends on the outcomes this team produces: whether our detections fire correctly, whether the threats that matter get surfaced, and whether customers trust what we tell them. You'll be the technical authority who validates the detections our researchers build (ModSecurity/WAF rules, API security signatures, AI security detections, OWASP Top 10 / API Top 10 / LLM Top 10 coverage), separates true positives from noise, hunts across global customer environments for business logic abuse and fraud, and closes the loop back to Research and Product to sharpen detection efficacy.

You'll bring a deep understanding of the security landscape — the threat models, attacker techniques, and rapidly evolving AI security frontier — and you'll express that understanding through code: scripting, automating threat hunts, and using AI itself as a force multiplier in your investigations.

Day to day, you'll work hand in hand with customers' own security teams to operationalize the Traceable by Harness Protection module and then stay engaged as an extended SOC and red team — continuously improving their security posture rather than handing off at go-live.

Operationalize the Protection module. Work directly with customers' security teams to stand up and tune the Traceable by Harness Protection module in their environment, from initial rollout through steady-state enforcement.

Be their extended SOC and red team. Engage continuously — not as a one-off deployment — acting as an extension of the customer's SOC to monitor and hunt, and as a red team to probe their defenses, steadily improving their overall security posture.

Evaluate detections built by Security Research Engineering. Review and pressure-test ModSecurity (ModSec) rulesets, API security detections, AI Security detections, and OWASP Top 10 / OWASP API Top 10 / OWASP LLM Top 10 coverage for accuracy, coverage gaps, and false-positive rates before and after they reach customers.

Validate true positives in production traffic. Partner directly with customer security teams to triage platform alerts, confirm genuine true positives, distinguish them from false positives and benign anomalies, and document the reasoning behind each verdict.

Automate the hunt. Build scripts, tooling, and automated workflows — increasingly AI-assisted — that scale threat hunting across many customers at once, rather than investigating one alert at a time by hand.

Run threat hunting engagements globally. Proactively hunt across the API traffic of Harness customers worldwide for business logic abuse (BOLA/BFLA, parameter tampering, workflow abuse), account takeover, credential stuffing, scraping, carding, and fraud patterns that signature-based detection alone won't catch.

Black-box test the platform and customer APIs. Attack detections and API endpoints the way a real adversary would — validating coverage, finding blind spots, and generating the adversarial traffic needed to confirm detections actually fire.

Own the detection feedback loop. Turn field findings into concrete, prioritized input for Security Research Engineering and Product — new rule ideas, tuning recommendations, catalog/detection integration gaps, and coverage improvements.

Reproduce and investigate incidents. Lead deep-dive investigations into anomalous API behavior, trace root cause (including upstream CDN/WAF/gateway layers), and produce clear RCA documentation and findings for both technical and executive audiences.

Weed out false positives and report on what matters (critical). Aggressively filter noise so customers aren't chasing false alarms, and deliver clear reports that surface genuine threat insights — helping customer teams focus their limited attention on the true incidents that actually require action. This signal-over-noise discipline is central to the value customers get from the platform.

Reduce customer noise at the source. Tune detections to each customer's API catalog, business context, and legitimate integration patterns so false positives are suppressed before they ever reach an analyst.

Be a trusted technical advisor. Translate detection logic and threat findings into language customer security leaders can act on, and help them mature their API and AI security posture.

This is a core technical role. We expect real depth — not surface familiarity — across most of the following:

Security frameworks & threat models: OWASP Top 10, OWASP API Security Top 10, and OWASP LLM (GenAI) Top 10; MITRE ATT&CK, and MITRE ATLAS for AI/ML threats.

API security: REST, GraphQL, and gRPC; authentication and authorization flows (OAuth 2.0, OIDC, JWT, session handling); and the full range of API attack techniques (BOLA/BFLA, mass assignment, injection, SSRF, rate-limit and workflow abuse).

AI / LLM security: prompt injection, sensitive-information disclosure, improper output handling, excessive agency, and abuse of AI-driven or agentic API endpoints — and how to detect them.

Detection & WAF engineering: hands-on with WAF / ModSecurity rule logic — reading, writing, tuning, and reasoning about false-positive / false-negative tradeoffs.

Offensive testing & tooling: black-box testing of APIs and detections using tools such as Burp Suite, Postman, and OWASP ZAP; generating adversarial traffic to confirm detections fire.

Scripting & automation: Python (or equivalent) to build investigation tooling and automated, increasingly AI-assisted hunt workflows; comfort querying large volumes of traffic and telemetry.

Threat hunting & fraud analysis: distinguishing business logic abuse and fraud from legitimate traffic — account takeover, credential stuffing, scraping, carding, and payment fraud.

Nice to Have

Familiarity with CDN, gateway, and upstream traffic architectures (Akamai, Cloudflare, and similar) and how they interact with detection at the edge.

Prior experience in a customer-facing security engineering, SOC, or professional services role.

Certifications (a plus, not required). Because this role centers on API and AI security, the most relevant credentials are:

API security: Certified API Pentester (C-APIPen), APIsec University ASCP, or PortSwigger Burp Suite Certified Practitioner (BSCP).

AI / LLM security: a hands-on AI security certification such as CAISP (Certified AI Security Professional) or equivalent.

Offensive / web depth: OSWE, GWAPT, or OSCP.

Note: AI-security certifications are still maturing, so demonstrated hands-on ability weighs more heavily than any specific badge.

Accelerating Our Mission to Bring AI to Everything After Code

Goldman Sachs leads investment in software delivery startup Harness at $5.5 billion valuation

How Harness runs 16 “startups within a startup” at scale | Jyoti Bansal

Harness Research Shows AI Visibility Crisis Fueling Security Nightmare

Harness has been named to the Inc. Power Partner list for software delivery success

All qualified applicants will receive consideration for employment without regard to race, color, religion, sex or national origin.

At Harness, we care about your privacy and are committed to protecting your personal data. For additional information on this topic, you can visit our privacy Portal: https://harness-privacy.relyance.ai/

Note on Fraudulent Recruiting/Offers

We have become aware that there may be fraudulent recruiting attempts being made by people posing as representatives of Harness. These scams may involve fake job postings, unsolicited emails, or messages claiming to be from our recruiters or hiring managers.

Please note, we do not ask for sensitive or financial information via chat, text, or social media, and any email communications will come from the domain @harness.io. Additionally, Harness will never ask for any payment, fee to be paid, or purchases to be made by a job applicant. All applicants are encouraged to apply directly to our open jobs via our website. Interviews are generally conducted via Zoom video conference unless the candidate requests other accommodations.

If you believe that you have been the target of an interview/offer scam by someone posing as a representative of Harness, please do not provide any personal or financial information and contact us immediately at security@harness.io. You can also find additional information about this type of scam and report any fraudulent employment offers via the Federal Trade Commission’s website ( https://consumer.ftc.gov/articles/job-scams), or you can contact your local law enforcement agency.