Full-Time

Software Engineer

AI Agents, Intermediate-Expert

Posted on 12/4/2025

Konvu

Konvu

11-50 employees

Prevents vulnerabilities with integrated application security

No salary listed

Paris, France

In Person

Category
Software Engineering (1)
Requirements
  • Several years of experience as a software or product engineer, ideally in startup or fast-moving environments.
  • Hands-on experience building with LLMs and AI tools, not just reading about them.
  • You’ve experimented with AI agents: Built agents or agent-like systems (tool-using LLMs, multi-step workflows, planners, etc.) in production, side projects, or open source.
  • Intellectual curiosity and a genuine drive to build and innovate.
  • Strong engineering fundamentals: you care about code quality, design, testing, and reliability.
  • Excellent communication in English (our working language).
  • Eagerness to work onsite from our Paris office.
Responsibilities
  • Build agentic products that solve real problems: Design and implement AI agents that help teams understand, prioritize, and act on vulnerabilities.
  • Ship value fast: Think deeply but act decisively: prototype, experiment, and iterate quickly. You’ll run experiments with agents, learn from failures, refine prompts/tools/context, and ship improvements to users.
  • Take ownership: Drive key product and technical work end-to-end. From defining the approach, to designing the agent architecture, to getting it running reliably in production.
  • Stay close to customers: Engage with users regularly (Slack, calls) to see how they use what you’ve built, where agents help, where they fail, and what needs to be improved. Then turn these insights into impactful features.
  • Design robust architectures: Build systems that exemplify strong engineering principles: clear, reliable, maintainable, and scalable. We prioritize thoughtful design and the practices that make engineering excellent like good tests, fast builds, strong observability, and good operational hygiene.
  • Leverage cutting‑edge agentic systems: Use modern LLMs, tool-use, planning, and multi-step workflows to build robust agentic vulnerability management capabilities. You’ll constantly explore how to make agents more reliable, controllable, and useful in real-world environments.
  • Shape our product and technical culture: Contribute your perspective on what to build, how to build it, and how we work as a team. As an early AI-focused engineer, you’ll influence our standards for agent design, evaluation, and safety.]
  • desirable:[]

Konvu operates in the application security space, offering a suite of security solutions designed to be integrated directly into applications. Its core goal is to prevent vulnerabilities before code is deployed, aligning with modern software development practices where AI assists code generation, testing, and deployment. The product is built to fit into the software development lifecycle (DevSecOps) and focuses on vulnerability prevention, code security, and automated testing and deployment. Compared with competitors, Konvu emphasizes seamless integration and preemptive security measures tailored for AI-driven development, rather than relying on post-development scanning or manual fixes. With $5 million in funding, its aim is to advance its security solutions to support the shift in application security paradigms driven by AI-enabled development.

Company Size

11-50

Company Stage

Seed

Total Funding

$5M

Headquarters

New York City, New York

Founded

2024

Simplify Jobs

Simplify's Take

What believers are saying

  • Selected for RSAC 2026 Launch Pad, boosting visibility among venture capitalists.
  • SEC disclosure rules drive demand for Konvu's triage amid scanner overload.
  • Secured $5 million funding in 2024 to scale AI-native vulnerability management.

What critics are saying

  • Snyk's DeepCode AI outperforms Konvu in false positive reduction, capturing 70% enterprise budgets.
  • Open-source Trivy and Grype with AI plugins erode Konvu's pricing at zero cost.
  • GitHub Copilot embeds native vuln triage in IDEs, bypassing Konvu within 18-24 months.

What makes Konvu unique

  • Konvu's exploitability engine combines reachability with AI prioritization for robust false-positive reduction.
  • AI agents integrate with SAST/SCA tools like Snyk and Semgrep without workflow disruption.
  • Named Supply Chain Innovator in Latio's 2026 Application Security Market Report.

Help us improve and share your feedback! Did you find this helpful?

Benefits

Company Equity

Flexible Work Hours

Growth & Insights and Company News

Headcount

6 month growth

9%

1 year growth

9%

2 year growth

0%
Konvu
Feb 18th, 2026
Konvu Selected as RSAC Launch Pad Finalist

Konvu selected as RSAC Launch Pad finalist. Lucas Masson 2026-02-18 Konvu has been selected as one of three finalists for RSAC Launch Pad at the RSAC 2026 Conference. On March 24 in San Francisco, Konvu Inc.'ll pitch its exploitability engine to a panel of top cybersecurity VCs in a Shark Tank-style format. Three startups, five minutes each, one winner. Three startups, five minutes, one stage at moscone. RSAC Launch Pad is the RSA Conference's competition for early-stage cybersecurity startups with bold ideas. Each year, RSA selects three finalists from a competitive applicant pool. Those three take the stage, pitch live to a panel of judges, and make their case in front of a packed audience of security professionals and investors. This year's judges are Sarah Guo of Conviction Partners, Barmak Meftah of Ballistic Ventures, and Enrique Salem of Bain Capital Ventures. Past Launch Pad finalists have collectively raised over $255M in funding. Two have been acquired, and two went on to compete in RSAC's Innovation Sandbox. The bet: exploitability is the missing layer. Security teams are buried under scanner output. Over 85% of flagged vulnerabilities turn out to be false positives, and the investigation work required to figure out which ones actually matter is crushing. AI is making it worse on both sides: more code, more dependencies, more findings, and attackers weaponizing new CVEs within days of publication. Konvu deploys AI agents that reason about whether a vulnerability is actually exploitable in your environment. Konvu Inc. model each vulnerability as a set of conditions, then verify those conditions against your code, configurations, and controls. The output is an evidence-backed verdict: exploitable, false positive, or inconclusive. When Konvu Inc. can't make the call automatically, Konvu Inc. tell you exactly what context is missing so your team can provide it and close the loop. Konvu Inc. is not replacing your scanners. Konvu Inc. plug into whatever you already run and add the exploitability layer on top. Your tools stay, your workflows stay, you just stop spending hours investigating findings that don't matter. I wrote about the full vision a few months ago if you want the longer story. Signals the problem resonates. A lot has happened in a short time. Earlier this week, Latio named Konvu a Supply Chain Innovator in their 2026 AppSec Market Report. James Berthoty called out Konvu for "combining all aspects of reachability with AI-based prioritization, resulting in some of the most robust false-positive reduction on the market." On the customer side, a fintech SaaS company with 2,000+ employees flagged 81% of their Snyk findings as false positives and saved 50+ hours per week on triage. That's developers building product instead of chasing alerts. Now the RSAC Launch Pad selection. These things are converging because the problem is obvious to anyone running a security program at scale, and the existing tooling isn't solving it. Meet Konvu Inc. in San Francisco at RSA Conference. Konvu Inc.'ll be at RSA Conference the week of March 24. If you want to meet the team or see a live demo, book a meeting. Can't make it to San Francisco? Book a demo and Konvu Inc.'ll walk through your own backlog.

Securities and Exchange Commission
Oct 10th, 2024
SEC FORM D

The Securities and Exchange Commission has not necessarily reviewed the information in this filing and has not determined if it is accurate and complete.The reader should not assume that the information is accurate and complete.

INACTIVE