Forward Deployed Engineer, Networking

Redpanda is pioneering the Agentic Data Plane (ADP) - a new category in AI infrastructure that makes it simple and secure to connect AI agents with enterprise data and systems. Built on a multi-modal data streaming engine, Redpanda empowers agentic applications that reason and act in real-time with speed, autonomy, and precision. Global leaders including Activision Blizzard, Cisco, Moody's, Texas Instruments, Vodafone and 2 of the top 5 banks in the U.S. rely on Redpanda to process hundreds of terabytes of data a day. Backed by premier venture investors Lightspeed, GV and Haystack VC, Redpanda is a diverse, people-first organization with teams distributed around the globe. About the Role: Redpanda is building the Agentic Data Platform (ADP) — the streaming and data infrastructure the world's largest enterprises run mission-critical agents on. Field Deployed Engineering (FDE) is the delivery arm. We embed engineers directly with strategic customers and build the agents and integrations that turn ADP into owned outcomes. This role is the networking specialist on the FDE team. You are the person customers' network, security, and platform teams sit across from when we deploy ADP into their environment. Many enterprise ADP deployments cross a private network boundary — into a VPC, across a hybrid network, behind an identity-aware proxy, integrated with public SaaS surfaces (Teams, Slack, identity providers, model APIs). The topology is never simple. You make it work. This is not a network engineer staffing a NOC. You are an engineer who can read code, build integrations, and ship — but your specialty is the network topology side of FDE engagements, where many enterprise deployments actually get stuck. You Will: Own the deployment topology of major enterprise engagements. For each customer, design and lock the network architecture: VPC layout, ingress/egress, private connectivity, DNS, identity-aware proxying, public-SaaS-to-private-VPC bridges. Document it so it survives handoff. Translate customer constraints into a workable architecture. Customer networks have ten years of accumulated decisions. SecOps owns egress. Platform owns the VPCs. Identity owns SSO. You meet them where they are, pull the architecture toward something that ships, and avoid breaking their existing posture. Herd customer-side teams. Network, security, platform, identity — getting them aligned on a deployment plan is the work. You drive that, with customer-facing communication that earns trust, not friction. Build the integrations that bridge the gap. When the topology demands code — an identity-aware proxy, a private link broker, an egress gateway, a webhook bridge — you write it. Production-quality, documented, deployable by the customer's team after you leave. Build alongside world-class Redpanda engineers to help shape ADP itself. You're not just deploying the platform — when the topology problem surfaces a gap in ADP's networking primitives, you work directly with Redpanda's core engineering team to extend the product. The networking patterns you discover in the field become first-class capabilities of ADP. This is engineering work upstream into the platform, not just delivery downstream into customers. Be the topology authority across the FDE function. Your FDE peers should be able to pull you in early when they smell a network problem. Build reusable patterns from each engagement so the second customer with the same shape doesn't re-litigate it. Feed learnings back. Topology blockers are pattern-rich. Identify the patterns across engagements — what customers keep needing, where ADP's deployment model creates friction, what should be productized (a templated VPC peering setup, a private-link broker, a Teams↔ADP webhook bridge). Bring that back to Product and Engineering clearly. You Have: Production networking depth. You've designed and operated enterprise cloud networks — VPC architecture in AWS / GCP / Azure, private connectivity (Transit Gateway, PrivateLink, ExpressRoute, Interconnect), hybrid networking, identity-aware proxies, egress controls. You've made architectural calls that held up under load and audit. Code that runs in production. You don't outsource the build. When the topology needs glue — an identity-aware proxy, a webhook bridge, a private-link broker, a network-aware deployment tool — you write it. Strong scripting / backend skills (Go, Python, TypeScript) and comfort with infrastructure-as-code (Terraform, Pulumi, CDK). SaaS-to-private-network integration patterns. You've built systems where a public SaaS (Slack, Teams, GitHub, OpenAI APIs, an identity provider) had to talk to something inside a customer's private VPC — and you've done it without compromising the customer's security posture. You know the menu of options (webhooks, reverse tunnels, identity-aware proxies, private endpoints, brokered architectures) and when to use each. Customer-facing communication. You can sit across from a customer's principal ne