高级产品工程师，策略引擎，AI 平台
Senior Product Engineer, Policy Engine, AI Platform
Redpanda 是首个用于代理数据交互的运行时和控制平面 —— 一个统一平台，将流处理、SQL 分析和智能连接与企业 AI 代理在生产环境中需要的治理层相结合。
建立在财富 500 强公司和快速成长的初创公司已信任的基础设施之上，Redpanda 完全在代理的数据路径之外实施治理，控制代理看到的内容，限制它们的行为，并记录不可篡改的全部操作记录，使组织无需在创新与控制之间做出选择。
**职位描述：**
针对 AI 代理的带内防御 —— 一种告诉模型如何行为的系统提示，或 LLM 自我审查其工具调用 —— 具有相同的故障模式：它们信任本应被约束的对象。带外策略引擎是 Redpanda 对此问题的解决方案，也是我们产品思维的核心之一：一个位于工具边界处的策略代理，完全在模型之外执行策略。代理的提示和工具界面保持字节级相同；代理是决定调用是否被授权、是否需要响应屏蔽或过滤、是否需要作用域缩小重写，或者是否需要转交人工审批步骤的实体。在我们自己的对抗基准测试中，这种方法在 99.8% 的尝试中保持了防御效果，而带内 LLM 保护审查器为 94.8%，仅提示防御为 85.6%——这个差距就是我们坚持这种复杂方式的原因。
策略语言已经得到认可，且存在一个工作原型 —— 九个可编写的操作符，涵盖授权、数据暴露和语义门控；两层策略组合；以及一个红队加盲审法官的基准测试框架，用于验证执行而非仅仅断言。接下来的工作是将该原型转化为生产基础设施：将其接入我们的 AI 网关作为真正的执行路径，构建编写体验，让安全团队能够有信心地编写和测试策略，并将每个决策记录为可审计、可回放的记录。我们正在寻找一位高级产品工程师来帮助构建这一系统 —— 这是一个高自主权、高度技术性的职位，处于 Redpanda 如何使代理 AI 足够安全以使安全团队愿意说“是”的核心位置。
**你具备：**
- 以攻击者的角度思考安全执行 —— 擅长推理策略未覆盖的内容，而不仅仅是它所覆盖的内容
- 对策略语言和策略执行机制有深刻理解，能够设计和实现复杂的策略逻辑
- 有构建和维护生产级系统的经验，熟悉 CI/CD、监控和日志系统
- 有跨团队协作的经验，能够与产品、工程和安全团队有效沟通
- 对 AI 代理和安全领域充满热情，愿意探索前沿技术并推动创新
查看英文原文
_Redpanda is the first runtime and control plane for agent-data interaction — a unified platform that combines streaming, SQL analytics, and intelligent connectivity with the governance layer enterprise AI agents need in production._
_Built on infrastructure already trusted by Fortune 500 companies and fast-growing startups, Redpanda enforces governance entirely outside the agent's data path, controlling what agents see, limiting what they do, and capturing a tamper-proof record of everything they touch, so organizations never have to choose between innovation and control._
**About the Role:**
In-band defenses for AI agents — a system prompt telling a model to behave, or an LLM reviewing its own tool calls — share the same failure mode: they trust the thing they're supposed to be constraining. The out-of-band policy engine is Redpanda's answer to that problem, and one of the fundamental thrusts of how we think about the product: a policy proxy that sits at the tool boundary and enforces outside the model entirely. The agent's prompt and tool surface stay byte-identical; the proxy is the thing deciding whether a call is authorized, needs its response masked or filtered, requires a scope-narrowing rewrite, or has to be deferred into a human-approval step. In our own adversarial benchmarking, this approach held its defense in 99.8% of attempts, against 94.8% for an in-band LLM guardrail reviewer and 85.6% for prompt-only defenses — the gap is the whole argument for building this the hard way.
The policy language is ratified and a working prototype exists — nine authorable operators spanning authorization, data exposure, and semantic gating; two-tier policy composition; and a red-team-plus-blinded-judge benchmark harness that certifies enforcement rather than just asserting it. What's ahead is turning that prototype into production infrastructure: wiring it into our AI gateway as the real enforcement path, building out the authoring experience so policies are something a security team can write and test with confidence, and landing every decision as an audited, replayable record. We're looking for a Senior Product Engineer to help build that — this is a high-ownership, deeply technical role at the center of how Redpanda makes agentic AI safe enough for security teams to say yes to.
**You are:**
- Someone who thinks about security enforcement the way an adversary would — comfortable reasoning about what a policy doesn't cover, not just what it does
- Excited to roll up your sleeves and do what it takes to deliver objective results
- Drawn to hard, precise systems problems — this is a proxy sitting in the request path of every governed tool call, where correctness and latency both matter
- Eager to thrive with the thrill and ethos of a fast growing startup
- Accountable, bring a sense of ownership, and are self-driven
**You have:**
- 5+ years of experience in software development, including building systems that enforce authorization or policy decisions in a live request path (a proxy, gateway, or middleware layer, not just a batch or offline check)
- Experience with policy-as-code systems such as Cedar, Open Policy Agent (Rego), XACML, or comparable authorization frameworks
- A solid understanding of AI agent and LLM system failure modes — prompt injection, tool misuse, data exfiltration through model output — and why defenses that live inside the model's own reasoning loop are fundamentally weaker than defenses that don't
- Comfortable with the mindset of adversarial testing: designing for attackers who are actively trying to defeat what you build, not just for well-behaved input
- Comfortable working with a globally distributed engineering team, collaborating on GitHub, in the open, and a self starter
- Strong verbal and written communication skills and demonstrated technical ownership
**You will:**
- Take the out-of-band policy engine from benchmarked prototype to production: wiring the Cedar-based enforcement proxy into our AI gateway as the real guardrail path for governed tool calls
- Build out the two-tier policy composition model — a per-tool-server data-owner ceiling composed with per-agent narrowing, most-restrictive wins — and the authoring experience that lets a security or compliance team write, test, and validate policies with confidence
- Extend the set of authorable policy operators across authorization, data exposure, and semantic gating, including the deferred-approval state that routes a call into human review rather than allowing or blocking it outright
- Land every enforcement decision as an audited, attributable record — the kind of durable evidence a customer's security team can actually review after the fact
- Maintain and extend the adversarial certification harness (multi-turn red-team adversary, blinded judge, deterministic leak metrics) so enforcement claims stay backed by evidence as the system evolves
- Work directly with design-partner customers in security-conscious industries to understand what a real security review actually demands of a policy engine, and feed that back into what you build
- Bring up difficult and/or systemic challenges and impediments to the attention of your manager
- Actively discuss strategic topics with peers to help shape the product's roadmap and how the team works
- Track progress, assess risks, and actively communicate contingency and mitigation plans for the systems you own
**Kindly highlight if applicable to you:**
- Direct experience with Cedar (AWS's policy language) specifically, or deep experience with a comparable policy-as-code language
- Experience building or operating a proxy or gateway that sits in a security-critical request path in production (API gateway, service mesh sidecar, egress/ingress proxy, or similar)
- Experience designing or running red-team / adversarial evaluation harnesses, including working with an LLM-as-judge evaluation setup
- Experience with LLM guardrail, content-safety, or prompt-injection defense systems, especially having seen their failure modes firsthand
- Experience with audit/compliance logging pipelines, especially ones that need to hold up as evidence for external security or regulatory review
_U.S. base salary range for this role is $205,000 - $230,000. Our salary ranges are determined by role, level, and location. We strive to consider each candidate's job-related skills, location, experience, relevant education or training to determine individual base salary. Your talent partner will share more about the specific salary range for your preferred location during the hiring process._
Join Redpanda if you’d enjoy being part of a fast-moving, diverse, people-first organization with team members around the globe and a culture based on trust, transparency, communication, and kindness. You'll dive into a nimble, high-impact team with the latest AI tools — and the budget to actually use them.