Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 73 days ago

Staff Security Engineer

Redpanda Data12 open roles

Pay
$210,000 – $247,000 a year
Where
US - Remote
Work mode
Remote
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowStaff Security EngineerRedpanda Data · US - Remote

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on Redpanda Data's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

11.5% of postings close within 7 days. Measured by our own scanner across the market. Redpanda Data postings stay open a median of 45 days.

Share of postings closed within
  1. 2.0%1 day
  2. 4.3%3 days
  3. 11.5%7 days
  4. 18.1%14 days
  5. 35.6%30 days
  6. 44.6%60 days
This job: posted 73 days ago

Redpanda Data median: 45 days open

The posting

Redpanda is the first runtime and control plane for agent-data interaction — a unified platform that combines streaming, SQL analytics, and intelligent connectivity with the governance layer enterprise AI agents need in production.

Built on infrastructure already trusted by Fortune 500 companies and fast-growing startups, Redpanda enforces governance entirely outside the agent's data path, controlling what agents see, limiting what they do, and capturing a tamper-proof record of everything they touch, so organizations never have to choose between innovation and control.

About the Role:

We're looking for an experienced Staff Security Engineer to own and scale application security across Redpanda's products, from the C++ core streaming engine to our Go cloud control plane, Console, and Rust/Go data-transform SDKs. Security at Redpanda is an engineering problem, not a checklist: you'll spend your time analyzing and breaking real systems code, building the paved roads and automation that make the secure path the default, and helping teams ship faster because security is built in rather than bolted on.

You'll be one of two engineers on a small, high-trust product security team, partnering every day with the engineers who build a system that Fortune 500 companies trust with their most critical data. Reporting to the Director of Information Security and working alongside our infrastructure security engineer, you'll own the day-to-day application-security work: secure SDLC, threat modeling, code-level vulnerability discovery, fuzzing the core engine, and our coordinated vulnerability disclosure and PSIRT response. As the application-security practice grows, you'll help shape its technical direction (in partnership with the Director, who owns the overall security program) and raise the security bar across all of engineering.

You Will:

- Lead threat modeling and secure design reviews for new product features across the C++ engine, Go control plane, and Console, catching trust-boundary and authorization flaws before code is written.

- Own and tune our application security testing (SAST, SCA / dependency scanning, secret scanning, and DAST) across C++, Go, and Rust, driving down false positives and gating the highest-severity findings in CI.

- Build the fuzzing harnesses for the core engine (coverage-guided and protocol-aware) and partner with platform engineering to run them continuously, integrating sanitizers to surface memory-safety and parsing defects early.

- Drive deep secure code review in systems languages, pairing your own expertise with AI-assisted analysis, and partner with engineering to eradicate whole classes of vulnerabilities rather than patching one bug at a time.

- Operate our product security incident response (PSIRT) and coordinated vulnerability disclosure: triaging external researcher reports, driving fixes with engineering, and publishing advisories and CVEs.

- Strengthen our software supply chain (dependency hygiene, SBOMs, build provenance, and progress toward higher SLSA build levels) in partnership with platform engineering.

- Stand up a security champions program and secure-by-default building blocks (libraries, patterns, guardrails) so engineering teams can own security with your support.

- Define security requirements and help shape the security release gates, and advise on product security features: authentication, authorization / RBAC, encryption, audit logging, multi-tenant isolation, and the Agentic Data Plane.

- Raise the security bar across engineering through pragmatic standards, training, and hands-on partnership, using modern AI-assisted development workflows (including tools like Claude Code) to scale your impact.

You Have:

- 7+ years in application or product security or adjacent specialties, with a track record of owning AppSec initiatives end-to-end and influencing engineering teams without direct authority.

- The ability to review and reason about code in a systems language (C++ or Rust strongly preferred, since our core engine is C++; Go valuable across the cloud control plane and tooling), whether reviewing it directly or with AI assistance, with strong instincts for memory safety, concurrency, and the vulnerability classes that matter (use-after-free, buffer overflow, injection, authorization flaws).

- Comfort with the security risks of memory-unsafe code and the appetite to fuzz it; fuzzing or sanitizer experience is a strong plus.

- Practical proficiency with the AppSec toolchain (SAST, SCA, secret scanning, DAST) and the judgment to apply risk-based prioritization rather than rigid textbook approaches.

- Demonstrated experience leading threat modeling and secure design reviews for non-trivial systems.

- Working knowledge of software supply-chain security (dependencies, SBOMs, signing, SLSA) and secure CI/CD practices.

- Familiarity with cloud (AWS / GCP / Azure) and Kubernetes security as it relates to the application layer.

- Excellent written and verbal communication skills; comfortable working in a globally distributed, async environment (e.g., GitHub).

Nice to Have:

- Experience with fuzzing (libFuzzer / AFL++ / OSS-Fuzz) and sanitizers (ASan / UBSan / MSan) on a C or C++ codebase.

- Background securing distributed systems, databases, or data-infrastructure products, including threat modeling consensus / replication and multi-tenant isolation.

- Experience running a PSIRT, operating as a CNA, or managing a bug bounty / coordinated disclosure program.

- Exposure to compliance programs (SOC 2, ISO 27001, HIPAA, FedRAMP) from the engineering-evidence side.

- Contributions to open-source security, or experience handling vulnerabilities in a public open-source repository.

U.S. base salary range for this role is $210,000 - $247,000. Our salary ranges are determined by role, level, and location. We strive to consider each candidate's job-related skills, location, experience, relevant education or training to determine individual base salary. Your talent partner will share more about the specific salary range for your preferred location during the hiring process.

Please note that Redpanda uses artificial intelligence (AI) technology to assist in the screening and assessment of applications for this position. However, all final hiring decisions are made by our human hiring team.

Vacancy Status: This job posting is for an existing vacancy.

Join Redpanda if you’d enjoy being part of a fast-moving, diverse, people-first organization with team members around the globe and a culture based on trust, transparency, communication, and kindness. You'll dive into a nimble, high-impact team with the latest AI tools — and the budget to actually use them.

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against Redpanda Data's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on Redpanda Data's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    Redpanda Data's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.