Full-Time
Senior Product Designer
Mondoo
11-50 employees
Unified security platform for IT exposure
No salary listed
Remote in USA
Remote
 UI/UX & Design (1) |
|---|
Get referred to Mondoo
See people who can refer or advise you
- Approximately 6 years of product design experience, ideally including experience at early-stage or fast-moving startups.
- A considered portfolio demonstrating detailed craft and broader product strategy.
- Strong command of typography, spacing, color theory, user experience clarity, and micro-interaction design.
- Comfort prototyping with code, working in a terminal, collaborating with engineers, and using AI tooling such as Claude Code to ship real components.
- A bias toward building beyond the Figma design.
- Strong collaboration skills and the ability to operate independently in a remote environment.
- The ability to tell stories and challenge obvious solutions.
- Experience designing for technical audiences such as developers, security engineers, or DevOps professionals is a plus.
- Mastery of Figma.
- Ability to read and inspect HTML and CSS, edit web pages, and preferably write or ship real code.
- Champion the company's design principles in all work.
- Explore multiple layouts, structures, and approaches before selecting and committing to a direction.
- Lead design for core platform initiatives from concept through final craft.
- Translate dense technical workflows into understandable user experiences.
- Partner with engineers to prototype real interactions in code, not only in Figma.
- Build and extend the design system in production using tools such as Claude Code alongside engineering.
- Challenge conventional solutions when they are not appropriate.
- Raise the team's quality bar through shipped work.
- Experience designing for technical audiences such as developers, security engineers, or DevOps professionals.
Mondoo helps organizations manage and reduce cyber exposure across their entire IT infrastructure by continuously discovering and inventorying assets such as on-premises servers, cloud services, SaaS apps, and employee endpoints. Its platform identifies, prioritizes, and remediates security vulnerabilities and misconfigurations through a data fabric that analyzes security data across environments, enabling clear risk insights. Security and compliance processes are automated and integrated into the development lifecycle from build to runtime, supporting DevSecOps workflows. Mondoo stands out by offering a unified framework for scanning across bare-metal servers, virtual machines, cloud environments, containers, and Kubernetes, with options ranging from a free open-source version to licensed commercial tiers. The goal is to help organizations reduce risk by providing continuous visibility, prioritized remediation, and automated compliance across all assets and environments.
Company Size
11-50
Company Stage
Early VC
Total Funding
$32.5M
Headquarters
San Francisco, California
Founded
2021
Get referred to Mondoo
See people who can refer or advise you
Simplify's Take
What believers are saying
- Mondoo claimed 300-plus customers and Fortune 50 logos in July 2026.
- Customers reported 60% fewer vulnerabilities and sub-16-day MTTR by March 2026.
- Black Hat 2026 and Google Cloud Next 2026 increased brand visibility and pipeline.
What critics are saying
- February 2026 layoffs signaled operating pressure and a smaller execution bench.
- Tenable, Rapid7, and Qualys already own vulnerability budgets Mondoo must displace.
- Free AI Skills Check and AI-BOM features commoditize Mondoo's paid product over 2026.
What makes Mondoo unique
- July 2026 AI-BOM tracks agents, skills, MCP servers, and models across endpoints.
- March 2026 managed service combines AI platform with remediation experts and approval workflows.
- Mondoo integrates Tenable, Rapid7, Qualys, Intune, CrowdStrike, and ServiceNow into one loop.
Help us improve and share your feedback! Did you find this helpful?
Benefits
Flexible Work Hours
Growth & Insights and Company News
6 month growth
↑ 2%1 year growth
↑ 7%2 year growth
↑ 7%Mondoo debuts free AI Skills Check to flag risky agent skills before installation. Managed vulnerability management service startup Mondoo Inc. today announced the launch of Mondoo AI Skills Check, a free security checker designed to address the growing supply chain risk posed by AI agent skills. The new free service, available without subscription, allows users to search for AI agent skills by name, registry or package URL to gain clear visibility into what they do, how they behave and the security risks they pose before installation. As organizations rapidly adopt agentic AI, the use of third-party skills introduces new and largely ungoverned security risks. This year has seen a rise in malicious skills that have ended up being installed into agents, often with access to credentials and sensitive systems, creating a new software supply chain layer that spans multiple agents and registries but remains largely invisible to existing security tools. AI Skills Check works across commonly used AI development environments, including Claude Code, Cursor, Windsurf, custom Anthropic SDK agents and Model Context Protocol servers and also supports skill registries such as ClawHub and Skills.sh. Designed to be agent-agnostic, the new offering provides an independent layer of analysis across any skill source, unlike registry-based scanning tools that operate within a single marketplace. It delivers a side-by-side comparison of what a skill claims to do versus what it actually does, using deep code and behavioral analysis to surface hidden risks. Mondoo is making the offering freely available to help organizations establish a baseline level of visibility and security as agentic AI adoption accelerates. The offering scans AI agent skills across four security layers, each designed to catch different categories of risk. The first layer, Pattern Match, identifies known malicious signatures and behaviors such as credential harvesting and data exfiltration. The second layer, ML Classifier, uses trained machine learning models to detect novel threats that don't match known patterns. Semantic Analysis, the third layer, evaluates descriptions and instructions to identify misleading claims or inconsistencies. The final layer, Deep Inspection, examines permissions, external interactions and actual behavior to determine if a skill aligns with its stated purpose. The result is a Common Vulnerability Scoring System-scored assessment with detailed findings, each tagged by severity and category. "Teams are installing AI agent skills with very little visibility into how they actually behave or what they have access to," said Patrick Münch, co-founder and chief security officer at Mondoo. ".hese skills can act on behalf of users, which raises the stakes significantly. We built AI Skills Check to close that gap, so organizations can see real risks before a skill even gets access to your systems and for free." The new service also offers real-time leaderboards that show the most popular skills ranked by stars and the "Most Risky List" that details widely used skills that carry the highest risk scores. It will be shown at the Google Cloud Next 2026 conference in Las Vegas this week. Mondoo has raised $32.5 million, including a round of $17.5 million in September. Investors in the company include HV Capital GmbH, T.Capital GmbH, Atomico Investment Holdings Ltd., Firstminute Capital LLP and System.One Management Ltd. Image: Mondoo. A message from John Furrier, co-founder of SiliconANGLE: Support its mission to keep content open and free by engaging with theCUBE community. Join theCUBE's Alumni Trust Network, where technology leaders connect, share intelligence and create opportunities. * 15M+ viewers of theCUBE videos, powering conversations across AI, cloud, cybersecurity and more * 11.4k+ theCUBE alumni - Connect with more than 11,400 tech and business leaders shaping the future through a unique trusted-based network. About SiliconANGLE Media SiliconANGLE Media is a recognized leader in digital media innovation, uniting breakthrough technology, strategic insights and real-time audience engagement. As the parent company of SiliconANGLE, theCUBE Network, theCUBE Research, CUBE365, theCUBE AI and theCUBE SuperStudios - with flagship locations in Silicon Valley and the New York Stock Exchange - SiliconANGLE Media operates at the intersection of media, technology and AI. Founded by tech visionaries John Furrier and Dave Vellante, SiliconANGLE Media has built a dynamic ecosystem of industry-leading digital media brands that reach 15+ million elite tech professionals. Its new proprietary theCUBE AI Video Cloud is breaking ground in audience interaction, leveraging theCUBEai.com neural network to help technology companies make data-driven decisions and stay at the forefront of industry conversations.
Mondoo has launched its Agentic Managed Vulnerability Service, combining security experts with its AI platform to deliver a 60% reduction in vulnerabilities and sub-16-day mean time to remediation. The San Francisco-based company also introduced an Automated Remediation Setup Service that deploys approved fixes through existing customer tools. The service addresses persistent challenges in vulnerability management, where organisations struggle to move beyond scanning and reporting. Mondoo research shows 91% of organisations lack confidence in their remediation ability, whilst 62% still rely on manual processes. The managed service pairs security professionals with Mondoo's AI platform, which collects data across cloud, on-premises, endpoints and software development lifecycles. The platform integrates with existing vulnerability tools including Tenable, Rapid7 and Qualys, providing a unified view of risk.
Mondoo launches Agentic Managed Vulnerability Service to accelerate remediation and improve outcomes. By GlobeNewswire March 17, 2026 World-class security experts, powered by Mondoo's proven AI platform, now deliver a 60% reduction in vulnerabilities and sub-16-day MTTR, so overwhelmed security teams don't have to do it alone SAN FRANCISCO, March 17, 2026 (GLOBE NEWSWIRE) - Mondoo, the pioneer in agentic vulnerability management, today announced the Mondoo Agentic Managed Vulnerability Service, a new expert-led offering that moves organizations from endless scanning and reporting to actual vulnerability remediation. Mondoo also introduced the Automated Remediation Setup Service, an optional add-on that establishes automated remediation workflows so approved fixes deploy instantly through customers' existing tooling. Most vulnerability management programs are stuck in an endless cycle of scanning and reporting. Even after prioritization, there are so many critical issues that it's increasingly difficult to know which to address first. This leads to critical vulnerabilities going unpatched, leaving organizations exposed or noncompliant. According to Mondoo's State of Vulnerability Remediation research, 91% of organizations lack confidence in their remediation ability, and 62% still rely on manual processes, contributing to industry-wide alert fatigue and growing security backlogs. "Most security teams aren't short on vulnerability data; they're short on the capacity to act on it," said Soo Choi-Andrews, CEO and Co-founder, Mondoo. "We built the Agentic Managed Vulnerability Service because we believe the industry needs to shift focus from reporting to outcomes. Our customers shouldn't need to hire more people just to keep up with the influx of vulnerabilities. With our world-class experts and proven AI platform, we deliver the results, 60% fewer vulnerabilities, mean-time-to-remediation under 16 days, and 10x faster than doing it manually, so our customers can focus on strategic work instead of chasing alerts." World-Class Experts Backed by a Proven AI Platform The Mondoo Agentic Managed Vulnerability Service pairs high-caliber security and IT operations professionals with Mondoo's AI-native platform to deliver fully optimized vulnerability management programs. Mondoo experts integrate with customer teams, taking full ownership of vulnerability monitoring, prioritization, remediation guidance, and reporting. The service is built on Mondoo's unified platform, which collects high-quality, high-fidelity data across the entire IT infrastructure, including cloud, on-premises, endpoints, SaaS, network devices, and the SDLC. In addition to Mondoo's native detections, the platform manages data from existing vulnerability tools such as Tenable, Rapid7, and Qualys, and ingests signals from CrowdStrike, SentinelOne, and Microsoft Defender, giving security teams a single, comprehensive view of their risk landscape. How It Works * Onboarding & Customization: Mondoo experts deploy the platform using the customer's preferred model, initiate continuous asset discovery, integrate with existing ITSM tools, and align scope and priorities to business objectives and risk tolerance. * Issue Prioritization: Experts triage vulnerability and compliance alerts to identify real risk based on local context, using Mondoo data queries to validate whether vulnerabilities actually pose a threat in the customer's specific environment. Zero-days, actively exploited CVEs, and government-flagged critical issues (CISA, BSI) are triaged with extra urgency through enriched threat intelligence. * Fix Suggestions: Mondoo creates actionable tickets in the customer's ITSM system (Jira, ServiceNow, GitHub Issues) with affected assets, prioritization rationale, remediation guidance, automation code (Ansible, PowerShell, Intune), and ready-to-approve pull requests. When no direct fix exists, Mondoo provides tailored mitigation advice. * Apply Fixes: Customers Retain 100% Control: The customer's security team reviews and approves all suggested fixes before implementation by copying code snippets, approving pull requests in their Git-based VCS, or clicking approve on ITSM tickets. Nothing is remediated without the customer's authorization. * Verification: Mondoo rescans after fixes are implemented to confirm remediation. Verified issues close automatically; recurring issues reopen if drift is detected. * Tracking & Reporting: Mondoo delivers ongoing reporting on issues resolved, open tickets, MTTR trends, patch and EOL status, integration health, certificate expirations, asset coverage, and compliance - with weekly standups, monthly executive reports, and quarterly business reviews. Advertisement New: Automated Remediation Setup Service Mondoo also introduced the Automated Remediation Setup Service, an optional deployment and configuration engagement that establishes automated remediation workflows for organizations in need of additional support. Mondoo experts integrate the platform with customers' existing deployment tooling (Microsoft Intune, Ansible, Puppet, Chef, SCCM), ensuring that fixes are automatically executed and verified once an analyst approves the remediation ticket. For organizations without existing deployment automation, Mondoo experts set up Ansible as an open-source remediation engine at no additional licensing cost. The analyst-driven workflow keeps security teams in full control: Mondoo identifies the issue and creates an enriched ticket, the analyst reviews and approves it, the fix deploys automatically through existing tooling, and Mondoo verifies the result, eliminating manual remediation toil while maintaining complete visibility and approval authority. MSSP And Channel Ready Mondoo Agentic Managed Vulnerability Service can be resold by Mondoo channel partners and is also MSSP-ready. Managed security service providers can partner with Mondoo to build and deliver their own branded managed vulnerability offerings, extending integrated, pervasive security protection to their client base. Deutsche Telekom, co-owner of T-Mobile and one of the world's largest telecommunications providers, already leverages Mondoo to secure its hybrid infrastructure, demonstrating the platform's ability to operate at enterprise scale in complex, multi-tenant environments. "The speed and accuracy of Mondoo's platform, combined with its deep insights into IT architecture, enables customers to quickly remediate issues and significantly reduce CVEs and policy violations," said Thomas Tschersich, CEO of Telekom Security & CSO of Deutsche Telekom AG. By partnering with Mondoo, MSSPs can expand their service portfolios with a differentiated, outcomes-driven vulnerability management offering backed by Mondoo's proven AI platform and guaranteed remediation results - delivering measurable value to their clients without building the capability from scratch. The Mondoo Agentic Managed Vulnerability Service and the Automated Remediation Setup Service are now available. For more information, visit www.mondoo.com or find Mondoo at RSA Conference, Booth 4425 in the North Expo Hall. About Mondoo Mondoo's Agentic Managed Vulnerability Service, a combination of local expert security professionals and a proven AI-native platform, delivers the outcomes security professionals need, helping them transition out of the endless cycle of scanning and reporting and into actual remediation. Trusted by more than 300 customers worldwide, including Fortune 50 companies, Mondoo prioritizes risks by business impact and exploitability, collects structured, context-aware data from the entire IT infrastructure, and provides actionable remediation guidance, including automation code and ready-to-approve pull requests, that eliminates vulnerabilities rather than just categorizing them. Mondoo's customers have reduced vulnerabilities by 60%, achieved mean-time-to-remediation under 16 days, and accelerated remediation 10x faster than manual approaches. With seamless ITSM integrations, transparent security pipelines, and guaranteed outcomes, Mondoo bridges the gap between security and engineering to fix what matters most to the business. Media Contact Will Clark Marketbridge for Mondoo
Mondoo launches agentic managed vulnerability service to accelerate remediation and improve outcomes.
Context-aware AI agents unify vulnerability prioritization, remediation and orchestration across enterprise IT infrastructure, security and platform engineering teams