Full Stack Security Engineer (Application & Product)

Runpod

Get hot jobs first on Telegram

New positions appear faster in our channel

Location: USA
Job Type: full-time
Work Format: 🌍 Remote
Salary: ($152,000 - $175,000)
Posted: August 11, 2026

Job Description

Runpod is the AI Developer Cloud. More than one million developers, from indie researchers to teams running frontier models in production, use Runpod to experiment, train, fine-tune, deploy, and scale AI on one platform. The platform has processed more than 20 billion inference requests. We closed a $100M Series A in June 2026. We're at an inflection point for AI infrastructure, and we're building the platform the next generation of developers will depend on.

We're a small, remote-first team. We take ownership seriously, move fast, and ship work that more than a million developers rely on every day. We're looking for people who care deeply, build with urgency, and want to matter at scale.

Learn more in our CEO's funding announcement: .

As Runpod continues to revolutionize the GPU cloud computing landscape, we are seeking a Full Stack Security Engineer to secure our customer-facing products, APIs, and internal services. This critical position will ensure the security of the software that powers our platform, enabling continued growth while protecting user data, billing systems, and web interfaces.

The ideal candidate possesses strong software development abilities coupled with deep experience in application security, DevSecOps, and modern web architectures. You will embed directly with our engineering teams to ensure our product is secure by design.

Runpod is seeking a proactive AppSec professional who believes in Integrated Security. You won't just toss PDF reports over the fence; you will write code to fix vulnerabilities, build automated security guardrails into our CI/CD pipelines, and foster a security-first culture among our developers.

Responsibilities:

Product Security: Lead threat modeling, architecture reviews, and code reviews for our web applications, APIs, and microservices.
Vulnerability Remediation: Actively develop and commit code to fix security flaws in our Python, Go, or JavaScript/TypeScript codebases alongside the engineering team.
DevSecOps: Implement, tune, and manage security testing tools (SAST, DAST, SCA) within our CI/CD pipelines to catch vulnerabilities early in the SDLC.
Edge & Application Defense: Configure and manage application-layer security controls, including Web Application Firewalls (WAF), bot protection, and API gateways.
Security Championing: Provide security guidance, secure coding training, and standard operating procedures to development teams.
Compliance & Operations: Collaborate with operations to ensure product-level adherence to relevant frameworks (e.g., SOC 2, ISO 27001, GDPR) and participate in bug bounty triage.

Required Qualifications:

5+ years of experience in application security, product security, or as a software engineer with a heavy security focus.
Strong programming and code-review skills in languages like Python, Go, JavaScript/TypeScript, or similar modern stacks.
Deep understanding of web application vulnerabilities (OWASP Top 10), API security (REST/GraphQL), and modern authentication flows (OAuth, OIDC, JWT).
Hands-on experience with offensive web security testing tools (e.g., Burp Suite, ZAP).
Experience building and maintaining automated security pipelines (DevSecOps).
Ability to translate complex security risks into actionable engineering tasks.

Preferred Qualifications:

Relevant application security certifications (e.g., OSWE, GWAPT, CISSP).
Experience securing cloud-native applications running on Kubernetes/Docker environments.
Background in managing bug bounty programs or coordinated vulnerability disclosures.

What You’ll Receive:

The competitive base pay for this position ranges from ($152,000 - $175,000). This salary range may be inclusive of several career levels at Runpod and will be narrowed during the interview process based on a number of factors, including the candidate’s experience, qualifications, and location
Meaningful equity in a fast-growing company- everyone on the team receives stock options — your impact drives our growth, and you share in the upside.
Generous medical, dental & vision plans
Flexible PTO- take the time you need to recharge
Most roles are remote work first with an inclusive, collaborative teams utilizing slack as the main form of internal communication
Join a passionate team on the cutting edge of AI infrastructure — where culture, learning, and ownership are at the heart of how we scale.
$1,200 Home Office & Equipment Stipend- We set you up for success from day one with gear and support to create your ideal workspace

Runpod is committed to maintaining a workplace free from discrimination and upholding the principles of equality and respect for all individuals. We believe that diversity in all its forms enhances our team. As an equal opportunity employer, Runpod is committed to creating an inclusive workforce at every level. We evaluate qualified applicants without regard to race, color, religion, sex, sexual orientation, gender identity, national origin, age, marital status, protected veteran status, disability status, or any other characteristic protected by law. We welcome every qualified candidate eligible to work in the United States; however, we are currently unable to sponsor employment visas.

🎯 Who is this job for?

This role is suitable for a Senior application or product security engineer with 5+ years of experience and strong software development skills in Python, Go, JavaScript, or TypeScript. Required expertise includes OWASP Top 10, REST/GraphQL API security, OAuth/OIDC/JWT, offensive testing with Burp Suite or ZAP, DevSecOps pipelines, and cloud-native environments. The candidate should be familiar with threat modeling, secure architecture and code reviews, vulnerability remediation, WAF and API gateway management, security training, compliance support, and bug bounty triage.

💬 Potential Interview Questions

How would you threat-model a customer-facing API and its supporting microservices?

Identify assets, trust boundaries, actors, entry points, and abuse cases, then assess threats using a framework such as STRIDE. Convert findings into prioritized mitigations, security requirements, and tests that can be tracked by the engineering team.

How would you secure REST and GraphQL APIs against common attacks?

Enforce strong authentication and authorization at every resolver or endpoint, validate schemas and inputs, apply rate limits, restrict query depth and complexity for GraphQL, and prevent excessive data exposure. Logging, monitoring, and consistent error handling should also avoid leaking sensitive information.

What are the main security risks of using JWTs, and how would you mitigate them?

Risks include weak signing algorithms, improper signature validation, token theft, excessive token lifetime, and trusting unverified claims. Use strict algorithm allowlists, validate issuer, audience, expiry, and nonce where applicable, keep access tokens short-lived, and use secure refresh-token rotation and storage.

How would you implement OAuth 2.0 and OIDC securely for a web application?

Use Authorization Code Flow with PKCE, validate the issuer, audience, state, nonce, redirect URI, and ID-token signature, and never expose client secrets in browser code. Redirect URIs should be exact, tokens should be handled securely, and scopes should follow least privilege.

How would you integrate SAST, DAST, and SCA into a CI/CD pipeline?

Run SAST and dependency scanning on pull requests, execute DAST against deployed test environments, and use risk-based thresholds to block critical or exploitable findings. Results should be deduplicated, assigned to owners, tracked through remediation, and tuned to minimize false positives without weakening coverage.

How would you review Python, Go, or TypeScript code for security issues?

Look for injection, broken authorization, unsafe deserialization, secret exposure, insecure dependencies, race conditions, and improper error handling. I would verify security-sensitive assumptions with tests and provide or commit a concrete fix rather than only documenting the vulnerability.

How would you configure a WAF and API gateway without disrupting legitimate traffic?

Start with monitoring and baseline traffic patterns, then enable managed rules with carefully scoped exclusions and progressive enforcement. Combine WAF controls with authentication, schema validation, rate limiting, bot detection, and continuous review of blocked requests and false positives.

How would you use Burp Suite or ZAP to test an API?

Map the API, authenticate with test accounts, inspect and modify requests, and test authorization boundaries, input validation, rate limits, business logic, and error responses. Automated scans should be supplemented with manual testing for privilege escalation, object-level authorization, and workflow abuse.

What security controls are especially important for applications running on Kubernetes?

Use least-privilege service accounts and RBAC, network policies, protected secrets, image scanning and signing, admission controls, and non-root containers with restricted capabilities. Workloads should also be isolated, patched, monitored, and configured with secure pod and cloud identity permissions.

How would you prioritize and remediate a vulnerability reported through a bug bounty program?

Validate the report, determine exploitability, affected assets, data exposure, and business impact, then assign severity and an owner with a clear remediation deadline. Communicate responsibly with the researcher, deploy and verify the fix, document lessons learned, and add regression tests or preventive controls.

📋 Job Summary

Runpod is the AI Developer Cloud powering experimentation, training, deployment, and scalable inference for more than one million developers. As a Full Stack Security Engineer, you’ll secure web applications, APIs, and services through threat modeling, code reviews, vulnerability remediation, DevSecOps pipelines, and WAF, bot-protection, and API-gateway management. You’ll work with Python, Go, JavaScript/TypeScript, REST/GraphQL, Kubernetes, Docker, SAST, DAST, SCA, Burp Suite, and ZAP. This is a full-time, remote-first role for candidates in the USA, offering $152,000–$175,000 plus equity, flexible PTO, comprehensive benefits, and a $1,200 home-office stipend—an excellent opportunity to shape security at the forefront of rapidly scaling AI infrastructure.