The opportunity
Runpod is the AI Developer Cloud. More than one million developers, from indie researchers to teams running frontier models in production, use Runpod to experiment, train, fine-tune, deploy, and scale AI on one platform.
What you'll do
Product Security: Lead threat modeling, architecture reviews, and code reviews for our web applications, APIs, and microservices.
Vulnerability Remediation: Actively develop and commit code to fix security flaws in our Python, Go, or JavaScript/TypeScript codebases alongside the engineering team.
DevSecOps: Implement, tune, and manage security testing tools (SAST, DAST,: SCA) within our CI/CD pipelines to catch vulnerabilities early in the SDLC.
Edge & Application Defense: Configure and manage application-layer security controls, including Web Application Firewalls (WAF), bot protection, and API gateways.
Security Championing: Provide security guidance, secure coding training, and standard operating procedures to development teams.
Compliance & Operations: Collaborate with operations to ensure product-level adherence to relevant frameworks (e.g., SOC 2, ISO 27001, GDPR) and participate in bug bounty triage.
What they're looking for
- + years of experience in application security, product security, or as a: software engineer with a heavy security focus.
- Strong programming and code-review skills in languages like Python, Go,: JavaScript/TypeScript, or similar modern stacks.
- Deep understanding of web application vulnerabilities (OWASP Top 10), API: security (REST/GraphQL), and modern authentication flows (OAuth, OIDC, JWT).
- Hands-on experience with offensive web security testing tools (e.g., Burp Suite, ZAP).
