Semgrep
semgrep.dev
Actively hiring
DevSecOps
Application Security
As featured in
View 11 jobs
Follow
Overview
News
Technologies
Salaries
Products
People
Growth
Offices
Jobs
Financials
Funding and backers
Total raised
$153M
2 rounds on record
Latest round
$100M
Series D · Feb 2025 · 20 mo ago
Team
137
US Form 5500 (plan participants) · Dec 2024
Hiring now
12
+2 posted in 30 days
Backers
7
Ballistic Ventures, Felicis
The money's age
Due for its next round
20 months since the last round · and hiring
Momentum
22/100
hiring for its size, in the news
Last sign of life
this month
a posting or a news item
The story so fareach stage dated by its source: the company's releases, the press, registers, filings
Jun 28
On the Hacker News front page GLM 5.2 beats Claude in our benchmarks · 1113 points
Apr 30
On the Hacker News front page Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library · 465 points
Mar 19
Launched Semgrep Launches Multimodal, Combining AI Reasoning With Rule-Based Analysis for Detection, Triage, and Remediation · businesswire.com
Aug 27, 2025
On the Hacker News front page Nx compromised: malware uses Claude code CLI to explore the filesystem · 493 points
Mar 15, 2025
On the Hacker News front page Popular GitHub Action tj-actions/changed-files is compromised · 282 points
Feb 5, 2025
Raised a round Series D $100M
Jan 22, 2025
Launched on Hacker News Show HN: Semgrep Assistant, a set of surgical AI tools for AppSec
Apr 18, 2023
Raised a round Venture round $53M · SiliconANGLE
Apr 22, 2021
On the Hacker News front page Semgrep: Semantic grep for code · 415 points
2017
Founded
Tractionpublic signals, read monthly
Funding rounds
| Round | Date | Amount | Investors | Source |
|---|---|---|---|---|
| Series D | Feb 2025 | $100M | — | wsj.com |
| Venture round | Apr 2023 | $53M | — | SiliconANGLE |
Registers and programsofficial lists and records that name the company
| Legal entity | Semgrep Inc. | its site |
Backed byfrom the funds' portfolios and accelerator catalogs
Ballistic Ventures 
Felicis 
Harpoon Ventures 
Lightspeed Venture Partners 
Menlo Ventures 
Redpoint Ventures 
Sequoia Capital Investors in similar startupsfunds that back the companies most like this one
backs Aikido Security, Jit
backs Aikido Security, Jit
backs Corgea
backs Endor Labs
backs Black Duck
Similar startupsby what they do, their industry and backers
Endor Labs is an application security company founded in 2021 that builds a platform for securing both human-written and AI-generated code…
Aikido Security is an application security company headquartered in Ghent, Belgium, and founded in 2022. The company offers a single…
Jit is an Israeli application security company that orchestrates open source security tools inside developer workflows. It applies security…
Black Duck delivers True Scale Application Security — SAST, SCA, DAST, and AI-powered AppSec — to help security and development teams…
Black Duck is a leading application security enterprise specializing in software supply chain security and open-source risk management. The…
Detect, prevent, and respond to software supply chain attacks. End-to-end protection for AI agents, developer machines, open source…
How Semgrep hires
Truth index
B 75/100
Median time to fill
75 days
Ghost roles
0%
Stale roles
80%
Reposted roles
0%
Semgrep scores B on the Alion truth index (A is best, E worst), measured over 5 open roles re-checked against its own hiring board: 0% look like ghost listings, 80% have gone stale and 0% are the same role posted again. Its roles close in a median of 75 days. It measures how much of what this employer publishes turns into a real, finite search - not the employer as a workplace. How the index is computed
Overview
Semgrep is a software security company that develops static analysis tools for finding bugs and vulnerabilities in source code. Its open-source Semgrep engine and commercial platform cover code scanning, supply chain dependency analysis and secrets detection, with AI-assisted triage for development and security teams. The company, originally known as r2c, has raised a $100 million Series D round. The company is headquartered in San Francisco, California, United States.
News
GitHub Actions SHA Pinning, Org-Wide
Tags are mutable, commit SHAs aren't. How we pinned every GitHub Action across an org after the tj-actions/changed-files compromise, plus what to avoid.
Read more
Report
The AI Supply Chain Has a Supply Chain Problem
Backdoors in AI models are nearly undetectable today. Learn why provenance and independent auditing need to become industry standards, not afterthoughts.
Read more
Report
GPT-5.6 vs GPT-5.5: AI Code Security Benchmark Results
We benchmarked OpenAI's GPT-5.6 (Luna, Terra, Sol) against GPT-5.5 for vulnerability detection. See recall, precision, and cost-per-true-positive results.
Read more
Report
We have Mythos at Home: GLM 5.2 beats Claude in our Cyber Benchmarks
Among models given nothing but a prompt, the best open-weight option beat Claude Opus 4.8.
Read more
Report
Introducing Semgrep Guardian: Real-Time Security for AI-Written Code
As AI agents write more of your code than ever, Semgrep Guardian scans and fixes vulnerabilities the moment they're introduced, directly in your IDE, before they ever reach production.
Read more
Report
Semgrep Scan Speed: How We Cut Hours Off File Targeting
Semgrep 1.162.0 fixes a file targeting bottleneck that caused scans on large repos to take hours, cutting P99 diff scan times from 60 minutes to under 12.
Read more
Report
How Semgrep Cut Taint Analysis Time by 75%
Semgrep Pro Engine 1.158.0 ships a redesigned taint analysis engine that cuts P95 scan times by 25%, brings P99 from 45 to 35 min, and delivers 3x+ speedups on large repos.
Read more
Report
Announcing Pyro Caml: The First Continuous Profiler for OCaml
Semgrep open-sources Pyro Caml 1.0.0, the first continuous profiler for OCaml. Learn how it uses Memprof, OCaml Runtime Events, and Pyroscope to profile production workloads running under gVisor with under 5% overhead.
Read more
Report
Claude Code, Codex, Semgrep, CodeQL & Trent vs 28 CWE-Bench CVE Vulnerabilities
We benchmarked 5 security tools on 28 real CVEs from CWE-Bench: Semgrep, CodeQL, OpenAI Codex, Claude Code, and our own agent. The surprising result wasn't the score. It was a gap inside the data.
Read more
Report
Show more news
Tech stack
Technologies named in job postings at Semgrep over the last 12 months, by layer, with the share of postings for each.
Technologies in use
44
Postings analysed
19
Stack modernity
86/100AI adopter
Languages
Python32%
TypeScript32%
JavaScript26%
PHP5%
Frameworks & libraries
React.js26%
Flask21%
SQLAlchemy21%
Metaflow5%
Databases
PostgreSQL11%
Cloud & platforms
Kubernetes32%
GitHub Actions26%
GitLab26%
Buildkite21%
AI & ML
LLM11%
Claude5%
GPT-45%
GPT-55%
Sign in to see how your skills match this stack
Sign In
Full Semgrep tech stack
44 technologies · by team · pay by technology · changes · similar stacks
Salary insights
Compensation ranges based on this company's open jobs
Median
$247k
Typical range
$190k – $288k
Open positions
10
10
Jobs
Senior
70%
Staff
20%
Architect
10%
| Level | Jobs | Median | Typical range |
|---|---|---|---|
| Senior | 7 | $247k | $190k – $288k |
| Staff | 2 | $263k | $237k – $288k |
| Architect | 1 | $277k | $277k |
Highest paying role
Staff Backend Software Engineer
$288k
Normalized to USD per year
All salaries at Semgrep
By role, level and city, against the market · 10 jobs with pay
Growth
Hiring Momentum
71/100
Growing
Open positions
12
2 opened / 2 closed in 30 days
Median time-to-fill
69 days
faster than 19% of the market
ATS activity
Every ~4 hours
Today
Hiring Dynamics
+100%
Hiring Focus
The percentage next to each role is its share of the company's job openings over the last 90 days; the arrow shows the shift versus the previous period.
Solutions
33% ▲
Leadership
22% ▼
Backend
11% ▲
Security
11% ▼
Marketing
11% ▼
Sales
11% ▲
Activity Timeline
Added Salesforce to stack
Sep 2026
Added OWASP to stack
Sep 2026
Added Agile to stack
Sep 2026
Added Slack to stack
Sep 2026
Added Ruby to stack
Sep 2026
Added PHP to stack
Sep 2026
Added Tool Use to stack
Sep 2026
Added Agentic Workflows to stack
Sep 2026
Added Dropbox to stack
Sep 2026
New location: Boston
Aug 2026
New location: Denver
Aug 2026
Added Metaflow to stack
Aug 2026
Offices
Where the company hires and what each office is for
Cities
4
Hiring now
4
Countries
1
Busiest office
San Francisco
Loading the map
Headquarters
Builds here
Office with open vacancies
Tap a pin for the office
San Francisco
United States
HQ
9 open roles 5 posted in 90 days 44% engineering 50-200 est. staff $259k Avg Salary
hires for Backend, Leadership, Product
New York
United States
Engineering / R&D
4 open roles 75% engineering 50-200 est. staff $248k Avg Salary
hires for Backend, Solutions
Denver
United States
Engineering / R&D
3 open roles 100% engineering 10-50 est. staff $260k Avg Salary
hires for Backend
Boston
United States
Engineering / R&D
3 open roles 100% engineering 10-50 est. staff $260k Avg Salary
hires for Backend
Jobs
Hybrid • Internship • San Francisco
Python
JavaScript
PHP
TypeScript
Ruby
PostgreSQL
Frontend
React.js
Cybersecurity
Semgrep
Management
Slack
Dropbox
Apply
$160k – $237k per year • Hybrid • Full-Time • 5+ years exp • San Francisco
Semgrep
Management
Dropbox
Apply
$197k – $288k per year • Hybrid • Full-Time • 3+ years exp • San Francisco
Semgrep
Management
Dropbox
Agile
Apply
$230k – $288k per year • Hybrid • Full-Time • 3+ years exp • San Francisco
Model Context Protocol
AI Agents
Cybersecurity
Semgrep
Management
Dropbox
Agile
Apply
$145k – $210k per year • Hybrid • Full-Time • 5+ years exp • New York
GitHub Actions
CircleCI
CI/CD
Jenkins
Git
Buildkite
GitLab
Cybersecurity
Semgrep
OWASP Top 10
Management
Dropbox
Apply
≈ $127k – $261k per year (Estimated) • Remote (APAC, United States) • Full-Time • 5+ years exp
GitHub Actions
CircleCI
CI/CD
Jenkins
Git
Buildkite
GitLab
Cybersecurity
Semgrep
OWASP Top 10
Management
Dropbox
Apply
$222k – $277k per year • Hybrid • Full-Time • 7+ years exp • San Francisco
Semgrep
Management
Dropbox
Apply
$152k – $190k per year • Remote (United States) • Full-Time • 5+ years exp • Bachelor's Degree
Azure DevOps
GitHub Actions
Azure
CI/CD
Bitbucket
GitLab
Cybersecurity
Semgrep
Management
Dropbox
Apply
$230k – $288k per year • Hybrid • Full-Time • San Francisco • New York • Denver • Boston
Python
JavaScript
TypeScript
Flask
SQLAlchemy
Frontend
React.js
DevOps
AWS
Kubernetes
Cybersecurity
Semgrep
Management
Dropbox
Apply
$163k – $247k per year • Hybrid • Full-Time • San Francisco • New York • Denver • Boston
Python
JavaScript
TypeScript
Flask
SQLAlchemy
Frontend
React.js
DevOps
AWS
Kubernetes
Cybersecurity
Semgrep
Management
Dropbox
Apply
$163k – $247k per year • Hybrid • Full-Time • San Francisco • New York • Denver • Boston
Python
JavaScript
TypeScript
Flask
SQLAlchemy
Frontend
React.js
DevOps
AWS
Kubernetes
Cybersecurity
Semgrep
Management
Dropbox
Apply