Staff Security Engineer
Confirmed on the employer's own hiring board on Oct 12, 2026. First seen by Alion on Sep 5, 2026.
Join Redpanda, a remote-first company, as a Staff Security Engineer. In this role, you will own and scale application security across Redpanda's products, including the C++ core streaming engine, Go cloud control plane, Console, and Rust/Go data-transform SDKs. You will work closely with engineering teams to integrate security into the development process and help shape the technical direction of the application-security practice.
Missions
- Analyzing and breaking real systems code, building automation for security, and helping teams ship faster.
- Leading threat modeling and secure design reviews for new product features, and owning application security testing.
- Driving deep secure code review in systems languages, partnering with engineering to eradicate vulnerabilities.
Profil recherché
- Comfort with the security risks of memory-unsafe code and the appetite to fuzz it; fuzzing or sanitizer experience is a strong plus- The ability to review and reason about code in a systems language (C++ or Rust strongly preferred, since our core engine is C++; Go valuable across the cloud control plane and tooling), whether reviewing it directly or with AI assistance, with strong instincts for memory safety, concurrency, and the vulnerability classes that matter (use-after-free, buffer overflow, injection, authorization flaws)
- Demonstrated experience leading threat modeling and secure design reviews for non-trivial systems
- Working knowledge of software supply-chain security (dependencies, SBOMs, signing, SLSA) and secure CI/CD practices
- Practical proficiency with the AppSec toolchain (SAST, SCA, secret scanning, DAST) and the judgment to apply risk-based prioritization rather than rigid textbook approaches
- Familiarity with cloud (AWS / GCP / Azure) and Kubernetes security as it relates to the application layer
- Excellent written and verbal communication skills; comfortable working in a globally distributed, async environment (e.g., GitHub)
- 7+ years in application or product security or adjacent specialties, with a track record of owning AppSec initiatives end-to-end and influencing engineering teams without direct authority
- Experience with fuzzing (libFuzzer / AFL++ / OSS-Fuzz) and sanitizers (ASan / UBSan / MSan) on a C or C++ codebase
- Background securing distributed systems, databases, or data-infrastructure products, including threat modeling consensus / replication and multi-tenant isolation
- Exposure to compliance programs (SOC 2, ISO 27001, HIPAA, FedRAMP) from the engineering-evidence side
- Experience running a PSIRT, operating as a CNA, or managing a bug bounty / coordinated disclosure program
- Contributions to open-source security, or experience handling vulnerabilities in a public open-source repository