Staff Security Engineer

ABOUT CODERABBIT CodeRabbit is the governance and control layer for agentic software development, helping engineering teams trust the code they ship. AI can generate code faster than people can review and understand it. Teams still need to know whether each change solves the right problem, fits their architecture, and is safe to ship. We provide independent validation grounded in codebase context and team standards, giving people the evidence they need to judge what should ship. Across Review, Triage, Explain, and Secure, our platform challenges changes before merge, prioritizes pull requests by value, impact, and risk, explains what changed and why it matters, and monitors the codebase for security vulnerabilities after merge. CodeRabbit serves nearly 20,000 customers and supports approximately 300,000 open-source repositories, performing over 2 million code reviews each week. Our $143M Series C, raised at a $1.5B valuation, supports further product development and international expansion. ABOUT THE ROLE We’re looking for a Staff Security Engineer to set technical direction and lead hands-on security work across CodeRabbit’s products, cloud infrastructure, identities, and AI systems. You’ll think like an attacker, build practical defenses, and partner with engineering, platform, and IT teams to reduce risk as we scale. This is a senior individual contributor role with company-wide influence. You’ll turn ambiguous security problems into prioritized engineering work, lead complex initiatives from design through rollout, and mentor engineers. Your impact will come from durable improvements to architecture, access controls, detection coverage, and incident readiness, as well as finding and fixing vulnerabilities. WHAT YOU’LL DO - Define and drive the technical security roadmap with engineering leaders, prioritizing work by customer impact, threat exposure, and business needs. Establish clear ownership and measure whether controls reduce risk. - Lead threat modeling and security architecture reviews for products, infrastructure, and major design changes. Build reusable patterns, guardrails, and automated checks that make secure development easier. - Improve cloud security across GCP, GKE/Kubernetes, and serverless workloads, covering network isolation, workload identity, secrets management, encryption and key management, container security, and infrastructure-as-code controls. - Lead identity and access management improvements for people, services, and automation: least privilege, SSO/MFA, privileged and time-bound access, service accounts, credential lifecycle management, access reviews, and joiner/mover/leaver controls. Partner with IT and platform teams on implementation. - Build and operate security detection capabilities using cloud audit logs, identity events, application telemetry, and endpoint signals. Develop and test SIEM detections, tune alerts, investigate suspicious activity, and improve visibility into credential misuse and unauthorized access. - Lead technical incident response for complex security events, from triage and investigation through containment, eradication, and recovery. Maintain playbooks, run exercises, coordinate with stakeholders, and drive root-cause fixes and post-incident improvements. - Plan and execute authorized offensive assessments, red team exercises, and adversary emulation across applications, APIs, cloud, and enterprise environments. Define scope and rules of engagement, validate impact safely, and turn findings into fixes and tested detections. - Assess AI and agentic-system risks, including prompt injection, tool and connector abuse, excessive agent permissions, RAG/vector-store poisoning, sensitive-data leakage, and trust boundaries between models, tools, and workloads. - Build security tooling and automation in Python, Go, or similar languages. Integrate preventive controls and security testing into CI/CD and work with engineers to validate remediation. - Improve vulnerability management and bug bounty or responsible disclosure triage, focusing on exploitability, remediation ownership, timelines, and recurring weaknesses. - Mentor engineers, lead cross-team technical decisions, and communicate security tradeoffs clearly to engineering leaders and non-technical stakeholders. Partner with compliance teams to ensure documented controls reflect how systems actually operate. YOU’LL BE A STRONG FIT IF YOU HAVE - Typically 8+ years of relevant security engineering experience, or equivalent demonstrated depth and impact, with a track record of leading complex initiatives across teams as a senior technical individual contributor. - Strong hands-on cloud and infrastructure security experience, including Kubernetes, networking, secrets and key management, and infrastructure as code. Deep expertise in at least one major cloud provider; GCP experience is particularly relevant. - Practical IAM expertise across workforce and workload identities, including least-privilege design, federation, service accounts, privileged access, credential management, and investigation of identity-based attacks. - Experience building and validating security detections, working with SIEM and cloud audit telemetry, and investigating incidents. Ability to lead response under pressure and translate lessons into lasting engineering improvements. - Strong application and offensive security skills, demonstrated through impactful internal findings, penetration tests, vulnerability research, responsible disclosures, bug bounty work, or security tooling. - Strong programming and automation skills, with the ability to build maintainable tools and contribute directly to production code and infrastructure changes. - Ability to reason through attack chains and system trust boundaries, use frameworks such as MITRE ATT&CK where useful, and balance preventive controls, detection, and response. - Proven ability to navigate ambiguity, influence architecture without direct authority, mentor engineers, and deliver measurable improvements across organizational boundaries. - Clear written and verbal communication, sound judgment, and the ability to explain risk and practical tradeoffs to technical and non-technical audiences. NICE TO HAVE - Experience securing AI/ML, LLM, RAG, or multi-agent systems, including OWASP guidance for LLM applications and AI red-team practices. - Experience securing developer platforms, source-code integrations, CI/CD pipelines, software supply chains, and customer credentials or tokens. - Experience with threat hunting, digital forensics, endpoint security, and detection-as-code workflows. - Experience supporting SOC 2 or ISO 27001 controls through engineering automation and evidence collection. - Contributions to security research, open-source tooling, responsible disclosure communities, or conference talks. Relevant practical certifications are a plus, not a substitute for demonstrated impact. OUR VALUES   1. 🤝 Collaborative Humans: Prioritizing collective intelligence 2. 🚀 Fearless Innovators: Turning obstacles into growth opportunities 3. 💪 Persistent, Passionate Developers: Thriving on complex, long-term challenges 4. 🎯 Impact-Driven Creators: Crafting intuitive tools for developers 5. 🧠 Rapid Learners and Un-learners: Adapting quickly in our fast-paced technological world   WHAT WE OFFER 1. Work on cutting-edge technology with real-world impact 2. Collaborative and innovative environment 3. Competitive salary, equity, and benefits 4. Professional development opportunities To apply, submit your resume and relevant project samples or GitHub profiles. CodeRabbit is an equal-opportunity employer committed to diversity and inclusion.