---
title: 'Staff Security Engineer at CodeRabbit'
canonical: 'https://feeny.ai/job/staff-security-engineer-coderabbit-bengaluru-wb0pxz6kfa66'
type: 'job'
last_seen: '2026-11-11'
---

# Staff Security Engineer at CodeRabbit

- **Company:** [CodeRabbit](https://feeny.ai/companies/coderabbit)
- **Location:** Bengaluru, India
- **Employment:** full-time
- **Work type:** onsite
- **Posted:** 2026-11-05
- **Last confirmed live:** 2026-11-11
- **Apply:** https://jobs.ashbyhq.com/coderabbit/da7f817e-677f-4951-966e-325d47d78079

## Job description

## About CodeRabbit

CodeRabbit is the governance and control layer for agentic software development, helping engineering teams trust the code they ship. AI can generate code faster than people can review and understand it. Teams still need to know whether each change solves the right problem, fits their architecture, and is safe to ship.

We provide independent validation grounded in codebase context and team standards, giving people the evidence they need to judge what should ship. Across Review, Triage, Explain, and Secure, our platform challenges changes before merge, prioritizes pull requests by value, impact, and risk, explains what changed and why it matters, and monitors the codebase for security vulnerabilities after merge.

CodeRabbit serves nearly 20,000 customers and supports approximately 300,000 open-source repositories, performing over 2 million code reviews each week. Our $143M Series C, raised at a $1.5B valuation, supports further product development and international expansion.

## About the Role

We’re looking for a Staff Security Engineer to set technical direction and lead hands-on security work across CodeRabbit’s products, cloud infrastructure, identities, and AI systems. You’ll think like an attacker, build practical defenses, and partner with engineering, platform, and IT teams to reduce risk as we scale. This is a senior individual contributor role with company-wide influence. You’ll turn ambiguous security problems into prioritized engineering work, lead complex initiatives from design through rollout, and mentor engineers. Your impact will come from durable improvements to architecture, access controls, detection coverage, and incident readiness, as well as finding and fixing vulnerabilities.

## What You’ll Do

- Define and drive the technical security roadmap with engineering leaders, prioritizing work by customer impact, threat exposure, and business needs. Establish clear ownership and measure whether controls reduce risk.
- Lead threat modeling and security architecture reviews for products, infrastructure, and major design changes. Build reusable patterns, guardrails, and automated checks that make secure development easier.
- Improve cloud security across GCP, GKE/Kubernetes, and serverless workloads, covering network isolation, workload identity, secrets management, encryption and key management, container security, and infrastructure-as-code controls.
- Lead identity and access management improvements for people, services, and automation: least privilege, SSO/MFA, privileged and time-bound access, service accounts, credential lifecycle management, access reviews, and joiner/mover/leaver controls. Partner with IT and platform teams on implementation.
- Build and operate security detection capabilities using cloud audit logs, identity events, application telemetry, and endpoint signals. Develop and test SIEM detections, tune alerts, investigate suspicious activity, and improve visibility into credential misuse and unauthorized access.
- Lead technical incident response for complex security events, from triage and investigation through containment, eradication, and recovery. Maintain playbooks, run exercises, coordinate with stakeholders, and drive root-cause fixes and post-incident improvements.
- Plan and execute authorized offensive assessments, red team exercises, and adversary emulation across applications, APIs, cloud, and enterprise environments. Define scope and rules of engagement, validate impact safely, and turn findings into fixes and tested detections.
- Assess AI and agentic-system risks, including prompt injection, tool and connector abuse, excessive agent permissions, RAG/vector-store poisoning, sensitive-data leakage, and trust boundaries between models, tools, and workloads.
- Build security tooling and automation in Python, Go, or similar languages. Integrate preventive controls and security testing into CI/CD and work with engineers to validate remediation.
- Improve vulnerability management and bug bounty or responsible disclosure triage, focusing on exploitability, remediation ownership, timelines, and recurring weaknesses.
- Mentor engineers, lead cross-team technical decisions, and communicate security tradeoffs clearly to engineering leaders and non-technical stakeholders. Partner with compliance teams to ensure documented controls reflect how systems actually operate.

You’ll Be a Strong Fit If You Have

- Typically 8+ years of relevant security engineering experience, or equivalent demonstrated depth and impact, with a track record of leading complex initiatives across teams as a senior technical individual contributor.
- Strong hands-on cloud and infrastructure security experience, including Kubernetes, networking, secrets and key management, and infrastructure as code. Deep expertise in at least one major cloud provider; GCP experience is particularly relevant.
- Practical IAM expertise across workforce and workload identities, including least-privilege design, federation, service accounts, privileged access, credential management, and investigation of identity-based attacks.
- Experience building and validating security detections, working with SIEM and cloud audit telemetry, and investigating incidents. Ability to lead response under pressure and translate lessons into lasting engineering improvements.
- Strong application and offensive security skills, demonstrated through impactful internal findings, penetration tests, vulnerability research, responsible disclosures, bug bounty work, or security tooling.
- Strong programming and automation skills, with the ability to build maintainable tools and contribute directly to production code and infrastructure changes.
- Ability to reason through attack chains and system trust boundaries, use frameworks such as MITRE ATT&CK where useful, and balance preventive controls, detection, and response.
- Proven ability to navigate ambiguity, influence architecture without direct authority, mentor engineers, and deliver measurable improvements across organizational boundaries.
- Clear written and verbal communication, sound judgment, and the ability to explain risk and practical tradeoffs to technical and non-technical audiences.

## Nice to Have

- Experience securing AI/ML, LLM, RAG, or multi-agent systems, including OWASP guidance for LLM applications and AI red-team practices.
- Experience securing developer platforms, source-code integrations, CI/CD pipelines, software supply chains, and customer credentials or tokens.
- Experience with threat hunting, digital forensics, endpoint security, and detection-as-code workflows.
- Experience supporting SOC 2 or ISO 27001 controls through engineering automation and evidence collection.
- Contributions to security research, open-source tooling, responsible disclosure communities, or conference talks. Relevant practical certifications are a plus, not a substitute for demonstrated impact.

## Our Values

- 🤝 Collaborative Humans: Prioritizing collective intelligence
- 🚀 Fearless Innovators: Turning obstacles into growth opportunities
- 💪 Persistent, Passionate Developers: Thriving on complex, long-term challenges
- 🎯 Impact-Driven Creators: Crafting intuitive tools for developers
- 🧠 Rapid Learners and Un-learners: Adapting quickly in our fast-paced technological world

## What We Offer

- Work on cutting-edge technology with real-world impact
- Collaborative and innovative environment
- Competitive salary, equity, and benefits
- Professional development opportunities

To apply, submit your resume and relevant project samples or GitHub profiles. CodeRabbit is an equal-opportunity employer committed to diversity and inclusion.

## About CodeRabbit

## Company Overview
- **One-liner**: CodeRabbit is an AI‑powered platform that automates the first pass of code reviews, providing context‑aware, human‑like feedback to help development teams ship faster and catch more bugs.
- **Entity Type**: Private (Series B; total funding $79.61M; last round $60M in October 2025)
- **Headquarters**: San Francisco, United States (also reported as Walnut Creek, California – conflicting reports)
- **Founded**: 2023
- **Founders**: Harjot Gill (CEO) is the primary founder; other co‑founders are not publicly disclosed.

## Core Business
- **Primary industries**: Software Development, AI‑powered Developer Tools
- **Target customers**: B2B, serving Engineering teams across SMB and Enterprise (15,000+ customers including The Economist, Life360, ConsumerAffairs, Hasura)
- **Mission / purpose**: “Revolutionize how code reviews are done” – enabling teams to move fast while maintaining code quality.

## Products & Services
- **CodeRabbit AI Review (SaaS / API)**: An AI‑powered code review agent that integrates with GitHub, GitLab, and other platforms. It provides line‑by‑line feedback, code suggestions, architectural diagrams, unit‑test generation, docstring creation, and a “Chat with CodeRabbit” feature. Supports custom guidelines, path/AST‑based instructions, and learns from developer feedback (“Learnings”).

## Market Standing
- **Valuation / Market Cap**: Not publicly disclosed (private company)
- **Key Metric**: **Total Funding** – $79.61 million raised (Series B led by Scale Venture Partners at $60M, October 2025)
- **Notable Investors / Partners**: Scale Venture Partners (lead, Series B), CRV (lead, Series A), Engineering Capital, Harmony Partners, NVentures (NVIDIA), and 8+ other investors.
- **Growth Signals**:
  - Headcount: 154 employees, **+363.6% year‑over‑year**.
  - Customer base grew to 15,000+.
  - SOC 2 Type II certified; GDPR compliant.
  - Acquired FluxNinja in 2024.
  - Claimed as “Most installed AI App” (quote attributed to Jensen Huang, NVIDIA CEO) on homepage.
  - Active job postings: **39** (yearly increase of +550%).

## Competitive Advantages
- **Continuous learning**: AI agent improves over time by incorporating developer feedback in natural language.
- **Deep context**: Uses Codegraph, MCP servers, linked issues (Jira, Linear), and web queries to understand dependencies across files.
- **Noise reduction**: 40+ linters and security scanners are integrated while false positives are filtered out.
- **Customizability**: Entire review workflow can be configured via a YAML file, including custom checks and coding guidelines.
- **Security‑first**: End‑to‑end encryption, zero data retention post‑review, independent SOC 2 Type II audits.

## Strategic Focus
- **Expand pre‑merge checks** and finishing touches (e.g., custom checks in natural language).
- **Deepen IDE & CLI integration** to review code even before PRs are created.
- **Enterprise growth**: Hiring senior sales roles (Enterprise AE, Sales Manager) and expanding into EMEA and APAC markets (e.g., South Korea).
- **Continuous improvement** of AI agent through user feedback and expanded external context sources.

## Why Work Here
- **Culture**: Described as fast‑paced, innovation‑driven, collaborative, and impact‑oriented. Values: fearless & innovative, persistent & passionate, impact‑driven.
- **Work model**: Hybrid/office‑first (San Francisco office with daily catered lunch); remote roles may be available for some positions.
- **Compensation & perks** (from careers page):
  - Unlimited PTO
  - Premium medical, dental, vision coverage
  - 401(k) for U.S. hires
  - Stock options (high growth potential)
  - Monthly commuter stipend
  - Learning & development stipend
- **Employee sentiment**: 3.8/5 on LinkedIn (11 reviews), with Compensation at 4.2, Career growth at 4.1, and Culture at 3.8.
- **Engineering culture**: Technical team makes up 28% of headcount; employees use and improve the AI tool themselves; strong emphasis on shipping fast without breaking things.

## Sources
1. [coderabbit.ai/careers](https://coderabbit.ai/careers)
2. [coderabbit.ai](https://coderabbit.ai/)
3. [cbinsights.com/company/coderabbit](https://www.cbinsights.com/company/coderabbit)
4. [linkedin.com/company/coderabbitai](https://www.linkedin.com/company/coderabbitai)
5. [jobs.ashbyhq.com/coderabbit](https://jobs.ashbyhq.com/coderabbit)

## Other roles at CodeRabbit

- [Head of Social Marketing](https://feeny.ai/job/head-of-social-marketing-coderabbit-san-francisco-6h6wyaya59kx) — San Francisco, CA
- [Head of Marketing Operations](https://feeny.ai/job/head-of-marketing-operations-coderabbit-xbt5a4wgq0y0)
- [Founding Account Executive - Enterprise - Seoul](https://feeny.ai/job/founding-account-executive-enterprise-seoul-coderabbit-south-korea-pd7w25mg0hvh) — South Korea
- [Founding Account Executive - Enterprise - Tokyo](https://feeny.ai/job/founding-account-executive-enterprise-tokyo-coderabbit-japan-wnv5tbeas0rp) — Japan
- [Director, Technical Sales Enablement](https://feeny.ai/job/director-technical-sales-enablement-coderabbit-san-francisco-b9qq9vn6q9y4) — San Francisco, CA
- [Global Field CTO](https://feeny.ai/job/global-field-cto-coderabbit-san-francisco-aajqmr347td1) — San Francisco, CA
- [Account Executive - Enterprise - Sydney](https://feeny.ai/job/account-executive-enterprise-sydney-coderabbit-australia-6qvm3k3q6jy3) — Australia
- [AI Operations Engineer, Americas](https://feeny.ai/job/ai-operations-engineer-americas-coderabbit-san-francisco-e2fwq6rzfq28) — San Francisco, CA / Boston, MA
- [Community Support Engineer](https://feeny.ai/job/community-support-engineer-coderabbit-san-francisco-0pvrxk17h7ez) — San Francisco, CA / Boston, MA
- [EMEA Account Executive - Emerging Enterprise - London](https://feeny.ai/job/emea-account-executive-emerging-enterprise-london-coderabbit-united-kingdom-a3kgg05mnz0g) — United Kingdom