Staff Security Engineer

About CodeRabbit CodeRabbit is the governance and control layer for agentic software development, helping engineering teams trust the code they ship. AI can generate code faster than people can review and understand it. Teams still need to know whether each change solves the right problem, fits their architecture, and is safe to ship. We provide independent validation grounded in codebase context and team standards, giving people the evidence they need to judge what should ship. Across Review, Triage, Explain, and Secure, our platform challenges changes before merge, prioritizes pull requests by value, impact, and risk, explains what changed and why it matters, and monitors the codebase for security vulnerabilities after merge. CodeRabbit serves nearly 20,000 customers and supports approximately 300,000 open-source repositories, performing over 2 million code reviews each week. Our $143M Series C, raised at a $1.5B valuation, supports further product development and international expansion. About the Role We’re looking for a Staff Security Engineer to set technical direction and lead hands-on security work across CodeRabbit’s products, cloud infrastructure, identities, and AI systems. You’ll think like an attacker, build practical defenses, and partner with engineering, platform, and IT teams to reduce risk as we scale. This is a senior individual contributor role with company-wide influence. You’ll turn ambiguous security problems into prioritized engineering work, lead complex initiatives from design through rollout, and mentor engineers. Your impact will come from durable improvements to architecture, access controls, detection coverage, and incident readiness, as well as finding and fixing vulnerabilities. What You’ll Do Define and drive the technical security roadmap with engineering leaders, prioritizing work by customer impact, threat exposure, and business needs. Establish clear ownership and measure whether controls reduce risk. Lead threat modeling and security architecture reviews for products, infrastructure, and major design changes. Build reusable patterns, guardrails, and automated checks that make secure development easier. Improve cloud security across GCP, GKE/Kubernetes, and serverless workloads, covering network isolation, workload identity, secrets management, encryption and key management, container security, and infrastructure-as-code controls. Lead identity and access management improvements for people, services, and automation: least privilege, SSO/MFA, privileged and time-bound access, service accounts, credential lifecycle management, access reviews, and joiner/mover/leaver controls. Partner with IT and platform teams on implementation. Build and operate security detection capabilities using cloud audit logs, identity events, application telemetry, and endpoint signals. Develop and test SIEM detections, tune alerts, investigate suspicious activity, and improve visibility into credential misuse and unauthorized access. Lead technical incident response for complex security events, from triage and investigation through containment, eradication, and recovery. Maintain playbooks, run exercises, coordinate with stakeholders, and drive root-cause fixes and post-incident improvements. Plan and execute authorized offensive assessments, red team exercises, and adversary emulation across applications, APIs, cloud, and enterprise environments. Define scope and rules of engagement, validate impact safely, and turn findings into fixes and tested detections. Assess AI and agentic-system risks, including prompt injection, tool and connector abuse, excessive agent permissions, RAG/vector-store poisoning, sensitive-data leakage, and trust boundaries between models, tools, and workloads. Build security tooling and automation in Python, Go, or similar languages. Integrate preventive controls and security testing into CI/CD and work with engineers to validate remediation. Improve vulnerability management and bug bounty o