Staff Security Engineer

About the role

ABOUT CODERABBIT

CodeRabbit is the governance and control layer for agentic software development, helping engineering teams trust the code they ship. AI can generate code faster than people can review and understand it. Teams still need to know whether each change solves the right problem, fits their architecture, and is safe to ship.

We provide independent validation grounded in codebase context and team standards, giving people the evidence they need to judge what should ship. Across Review, Triage, Explain, and Secure, our platform challenges changes before merge, prioritizes pull requests by value, impact, and risk, explains what changed and why it matters, and monitors the codebase for security vulnerabilities after merge.

CodeRabbit serves nearly 20,000 customers and supports approximately 300,000 open-source repositories, performing over 2 million code reviews each week. Our $143M Series C, raised at a $1.5B valuation, supports further product development and international expansion.

ABOUT THE ROLE

We’re looking for a Staff Security Engineer to set technical direction and lead hands-on security work across CodeRabbit’s products, cloud infrastructure, identities, and AI systems. You’ll think like an attacker, build practical defenses, and partner with engineering, platform, and IT teams to reduce risk as we scale.

This is a senior individual contributor role with company-wide influence. You’ll turn ambiguous security problems into prioritized engineering work, lead complex initiatives from design through rollout, and mentor engineers. Your impact will come from durable improvements to architecture, access controls, detection coverage, and incident readiness, as well as finding and fixing vulnerabilities.

WHAT YOU’LL DO

- Define and drive the technical security roadmap with engineering leaders, prioritizing work by customer impact, threat exposure, and business needs. Establish clear ownership and measure whether controls reduce risk.

- Lead threat modeling and security architecture reviews for products, infrastructure, and major design changes. Build reusable patterns, guardrails, and automated checks that make secure development easier.

- Improve cloud security across GCP, GKE/Kubernetes, and serverless workloads, covering network isolation, workload identity, secrets management, encryption and key management, container security, and infrastructure-as-code controls.

- Lead identity and access management improvements for people, services, and automation: least privilege, SSO/MFA, privileged and time-bound access, service accounts, credential lifecycle management, access reviews, and joiner/mover/leaver controls. Partner with IT and platform teams on implementation.

- Build and operate security detection capabilities using cloud audit logs, identity events, application telemetry, and endpoint signals. Develop and test SIEM detections, tune alerts, investigate suspicious activity, and improve visibility into credential misuse and unauthorized access.