Remote Full-Stack Security Engineer

RunPod; United States; On-site; USD 152,000 - 175,000; Full time

Benefits offered by this job

Equity

Remote-friendly culture

Medical/Dental/Vision

Job summary

Runpod, the AI Developer Cloud, is seeking a Full Stack Security Engineer to secure customer-facing products, APIs, and internal services. This critical role embeds with engineering teams to ensure security by design and to fix vulnerabilities across Python, Go, and JavaScript/TypeScript codebases.

We value hands-on DevSecOps, threat modeling, and experience with WAFs, OAuth/OIDC, and SOC 2/GDPR compliance, with a remote-first environment and meaningful equity.

Qualifications

• 5+ years in application security or as a software engineer with security focus.
• Strong programming and code review in Python, Go, or JavaScript/TypeScript.
• Deep understanding of web vuln risks (OWASP Top 10) and API security.
• Hands-on experience with automated security pipelines (DevSecOps).
• Ability to translate security risks into engineering tasks.
• Experience with security tooling (SAST/DAST/SCA) and CI/CD.

Responsibilities

• Lead threat modeling, architecture reviews, and code reviews for web apps, APIs, and microservices.
• Develop and commit code to fix security flaws in Python/Go/JS codebases.
• Implement and manage security testing tools within CI/CD pipelines.
• Configure application-layer security controls, including WAFs and API gateways.
• Provide security guidance and secure coding training to teams.
• Collaborate with operations to meet SOC 2, ISO 27001, GDPR requirements.

Skills

Python

Go

JavaScript/TypeScript

OWASP Top 10

DevSecOps

Tools

Burp Suite

ZAP

Job description

Runpod, the AI Developer Cloud, is seeking a Full Stack Security Engineer to secure customer-facing products, APIs, and internal services. This critical role embeds with engineering teams to ensure security by design and to fix vulnerabilities across Python, Go, and JavaScript/TypeScript codebases.

We value hands-on DevSecOps, threat modeling, and experience with WAFs, OAuth/OIDC, and SOC 2/GDPR compliance, with a remote-first environment and meaningful equity.