Full Stack Security Engineer (Application & Product) - Runpod

About Runpod

Runpod is the AI Developer Cloud. More than one million developers, from indie researchers to teams running frontier models in production, use Runpod to experiment, train, fine-tune, deploy, and scale AI on one platform. The platform has processed more than 20 billion inference requests.

We're a small, remote-first team. We take ownership seriously, move fast, and ship work that more than a million developers rely on every day.

Learn more in our funding announcement.

Role Overview

As Runpod continues to revolutionize the GPU cloud computing landscape, we are seeking a Full Stack Security Engineer to secure our customer-facing products, APIs, and internal services. This critical position will ensure the security of the software that powers our platform, enabling continued growth while protecting user data, billing systems, and web interfaces.

We are looking for a proactive AppSec professional who believes in integrated security. You won't just toss reports over the fence; you will write code to fix vulnerabilities, build automated security guardrails into our CI/CD pipelines, and foster a security-first culture among our developers.

Responsibilities

• Product Security: Lead threat modeling, architecture reviews, and code reviews for web applications, APIs, and microservices.
• Vulnerability Remediation: Actively develop and commit code to fix security flaws in Python, Go, or JavaScript/TypeScript codebases alongside the engineering team.
• DevSecOps: Implement, tune, and manage security testing tools (SAST, DAST, SCA) within CI/CD pipelines to catch vulnerabilities early in the SDLC.
• Edge & Application Defense: Configure and manage application-layer security controls, including Web Application Firewalls (WAF), bot protection, and API gateways.
• Security Championing: Provide security guidance, secure coding training, and standard operating procedures to development teams.
• Compliance & Operations: Collaborate with operations to ensure product-level adherence to relevant frameworks (e.g., SOC 2, ISO 27001, GDPR) and participate in bug bounty triage.

Required Qualifications

• 5+ years of experience in application security, product security, or as a software engineer with a heavy security focus.
• Strong programming and code-review skills in Python, Go, JavaScript/TypeScript, or similar modern stacks.
• Deep understanding of web application vulnerabilities (OWASP Top 10), API security (REST/GraphQL), and modern authentication flows (OAuth, OIDC, JWT).
• Hands-on experience with offensive web security testing tools (e.g., Burp Suite, ZAP).
• Experience building and maintaining automated security pipelines (DevSecOps).
• Ability to translate complex security risks into actionable engineering tasks.

Preferred Qualifications

• Relevant application security certifications (e.g., OSWE, GWAPT, CISSP).
• Experience securing cloud-native applications running on Kubernetes/Docker environments.
• Background in managing bug bounty programs or coordinated vulnerability disclosures.

Compensation & Benefits

• Base Salary: $152,000 - $220,000 USD, depending on experience and location.
• Equity: Meaningful stock options package.
• Health Coverage: Generous medical, dental, and vision plans.
• Paid Time Off: Flexible PTO policy.
• Stipend: $1,200 Home Office & Equipment Stipend.
• Work Setup: Remote-first culture utilizing Slack for collaboration.

Runpod welcomes qualified candidates eligible to work in the United States. We are currently unable to sponsor employment visas.