Staff AppSec Engineer: Core Engine & Cloud

Redpanda Data; United States; Remote; USD 210,000 - 247,000; Full time

Job summary

Redpanda Data is seeking a Staff Security Engineer to own and scale application security across its products, from the C++ core engine to the Go cloud control plane and Rust/Go SDKs. You will lead threat modeling, code-level vulnerability discovery, fuzzing, and PSIRT operations in a small, high-trust team.

You will work with engineers across language ecosystems, drive secure SDLC practices, and shape security direction in collaboration with the Director of Information Security.

Qualifications

• 7+ years in application or product security or adjacent specialties.
• Ability to review C++/Rust code with memory-safety mindset.
• Experience with AppSec toolchain: SAST, SCA, DAST.
• Proven track record in threat modeling and secure design reviews.

Responsibilities

• Lead threat modeling and secure design reviews for new features across C++ engine, Go control plane, and Console.
• Own and tune application security testing across languages; drive down false positives.
• Build fuzzing harnesses for the core engine and run them with sanitizers.
• Drive secure code review and reduce vulnerabilities through AI-assisted analysis.
• Operate PSIRT and coordinated vulnerability disclosure; publish advisories and CVEs.
• Strengthen software supply chain with SBOMs, build provenance, and higher SLSA levels.
• Stand up security champions program and secure-by-default building blocks.
• Define security requirements and advise on authentication, RBAC, encryption, audit logging.

Skills

C++

Rust

Go

Memory safety

Threat modeling

Secure design reviews

AppSec tooling

Tools

SAST

SCA

DAST

Fuzzing tooling

Job description

Redpanda Data is seeking a Staff Security Engineer to own and scale application security across its products, from the C++ core engine to the Go cloud control plane and Rust/Go SDKs. You will lead threat modeling, code-level vulnerability discovery, fuzzing, and PSIRT operations in a small, high-trust team.

You will work with engineers across language ecosystems, drive secure SDLC practices, and shape security direction in collaboration with the Director of Information Security.