{"id":3793353,"url":"https://alion.io/job/coderabbit-staff-security-engineer","title":"Staff Security Engineer","company":{"id":35010,"name":"CodeRabbit","domain":"coderabbit.ai","url":"https://alion.io/company/coderabbit-ai","size_band":"501-1000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Ashby","truth_index":{"grade":"A","score":93,"open_postings":29,"ghost_share":0,"stale_share":0.069,"repost_share":0,"time_to_fill_p50_days":98,"computed_at":"2026-11-06T05:58:05Z"}},"role":"Security","role_family":"Security","seniority":"staff","employment_type":"full_time","work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["Bengaluru, India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":null,"experience_years_min":8,"visa_sponsorship":false,"relocation_package":false,"has_equity":false,"technologies":[{"name":"AI Agents","optional":false},{"name":"CI/CD","optional":false},{"name":"GCP","optional":false},{"name":"Go","optional":false},{"name":"Google GKE","optional":false},{"name":"IAM","optional":false},{"name":"Kubernetes","optional":false},{"name":"Least Privilege","optional":false},{"name":"MITRE ATT&CK","optional":false},{"name":"Python","optional":false},{"name":"RAG","optional":false},{"name":"Red Teaming","optional":false},{"name":"SIEM","optional":false},{"name":"Threat Modeling","optional":false},{"name":"GitHub","optional":true},{"name":"ISO 27001","optional":true},{"name":"LLM","optional":true},{"name":"Multi-Agent Systems","optional":true},{"name":"OWASP","optional":true},{"name":"SOC 2","optional":true}],"status":"live","first_seen_at":"2026-11-05T06:38:51Z","employer_posted_date":"2026-11-05","last_verified_at":"2026-11-06T20:44:45Z","board_verified":true,"closed_at":null,"days_open":1,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":1},"description":"About CodeRabbit\nCodeRabbit is the governance and control layer for agentic software development, helping engineering teams trust the code they ship. AI can generate code faster than people can review and understand it. Teams still need to know whether each change solves the right problem, fits their architecture, and is safe to ship.\nWe provide independent validation grounded in codebase context and team standards, giving people the evidence they need to judge what should ship. Across Review, Triage, Explain, and Secure, our platform challenges changes before merge, prioritizes pull requests by value, impact, and risk, explains what changed and why it matters, and monitors the codebase for security vulnerabilities after merge.\nCodeRabbit serves nearly 20,000 customers and supports approximately 300,000 open-source repositories, performing over 2 million code reviews each week. Our $143M Series C, raised at a $1.5B valuation, supports further product development and international expansion.\nAbout the Role\nWe’re looking for a Staff Security Engineer to set technical direction and lead hands-on security work across CodeRabbit’s products, cloud infrastructure, identities, and AI systems. You’ll think like an attacker, build practical defenses, and partner with engineering, platform, and IT teams to reduce risk as we scale.\nThis is a senior individual contributor role with company-wide influence. You’ll turn ambiguous security problems into prioritized engineering work, lead complex initiatives from design through rollout, and mentor engineers. Your impact will come from durable improvements to architecture, access controls, detection coverage, and incident readiness, as well as finding and fixing vulnerabilities.\nWhat You’ll Do\nDefine and drive the technical security roadmap with engineering leaders, prioritizing work by customer impact, threat exposure, and business needs. Establish clear ownership and measure whether controls reduce risk.\n\nLead threat modeling and security architecture reviews for products, infrastructure, and major design changes. Build reusable patterns, guardrails, and automated checks that make secure development easier.\n\nImprove cloud security across GCP, GKE/Kubernetes, and serverless workloads, covering network isolation, workload identity, secrets management, encryption and key management, container security, and infrastructure-as-code controls.\n\nLead identity and access management improvements for people, services, and automation: least privilege, SSO/MFA, privileged and time-bound access, service accounts, credential lifecycle management, access reviews, and joiner/mover/leaver controls. Partner with IT and platform teams on implementation.\n\nBuild and operate security detection capabilities using cloud audit logs, identity events, application telemetry, and endpoint signals. Develop and test SIEM detections, tune alerts, investigate suspicious activity, and improve visibility into credential misuse and unauthorized access.\n\nLead technical incident response for complex security events, from triage and investigation through containment, eradication, and recovery. Maintain playbooks, run exercises, coordinate with stakeholders, and drive root-cause fixes and post-incident improvements.\n\nPlan and execute authorized offensive assessments, red team exercises, and adversary emulation across applications, APIs, cloud, and enterprise environments. Define scope and rules of engagement, validate impact safely, and turn findings into fixes and tested detections.\n\nAssess AI and agentic-system risks, including prompt injection, tool and connector abuse, excessive agent permissions, RAG/vector-store poisoning, sensitive-data leakage, and trust boundaries between models, tools, and workloads.\n\nBuild security tooling and automation in Python, Go, or similar languages. Integrate preventive controls and security testing into CI/CD and work with engineers to validate remediation.\n\nImprove vulnerability management and bug bounty or responsible disclosure triage, focusing on exploitability, remediation ownership, timelines, and recurring weaknesses.\n\nMentor engineers, lead cross-team technical decisions, and communicate security tradeoffs clearly to engineering leaders and non-technical stakeholders. Partner with compliance teams to ensure documented controls reflect how systems actually operate.\n\nYou’ll Be a Strong Fit If You Have\nTypically 8+ years of relevant security engineering experience, or equivalent demonstrated depth and impact, with a track record of leading complex initiatives across teams as a senior technical individual contributor.\n\nStrong hands-on cloud and infrastructure security experience, including Kubernetes, networking, secrets and key management, and infrastructure as code. Deep expertise in at least one major cloud provider; GCP experience is particularly relevant.\n\nPractical IAM expertise across workforce and workload identities, including least-privilege design, federation, service accounts, privileged access, credential management, and investigation of identity-based attacks.\n\nExperience building and validating security detections, working with SIEM and cloud audit telemetry, and investigating incidents. Ability to lead response under pressure and translate lessons into lasting engineering improvements.\n\nStrong application and offensive security skills, demonstrated through impactful internal findings, penetration tests, vulnerability research, responsible disclosures, bug bounty work, or security tooling.\n\nStrong programming and automation skills, with the ability to build maintainable tools and contribute directly to production code and infrastructure changes.\n\nAbility to reason through attack chains and system trust boundaries, use frameworks such as MITRE ATT&CK where useful, and balance preventive controls, detection, and response.\n\nProven ability to navigate ambiguity, influence architecture without direct authority, mentor engineers, and deliver measurable improvements across organizational boundaries.\n\nClear written and verbal communication, sound judgment, and the ability to explain risk and practical tradeoffs to technical and non-technical audiences.\n\nNice to Have\nExperience securing AI/ML, LLM, RAG, or multi-agent systems, including OWASP guidance for LLM applications and AI red-team practices.\n\nExperience securing developer platforms, source-code integrations, CI/CD pipelines, software supply chains, and customer credentials or tokens.\n\nExperience with threat hunting, digital forensics, endpoint security, and detection-as-code workflows.\n\nExperience supporting SOC 2 or ISO 27001 controls through engineering automation and evidence collection.\n\nContributions to security research, open-source tooling, responsible disclosure communities, or conference talks. Relevant practical certifications are a plus, not a substitute for demonstrated impact.\n\nOur Values\nCollaborative Humans: Prioritizing collective intelligence\n\nFearless Innovators: Turning obstacles into growth opportunities\n\nPersistent, Passionate Developers: Thriving on complex, long-term challenges\n\nImpact-Driven Creators: Crafting intuitive tools for developers\n\nRapid Learners and Un-learners: Adapting quickly in our fast-paced technological world\n\nWhat We Offer\nWork on cutting-edge technology with real-world impact\n\nCollaborative and innovative environment\n\nCompetitive salary, equity, and benefits\n\nProfessional development opportunities\nTo apply, submit your resume and relevant project samples or GitHub profiles. CodeRabbit is an equal-opportunity employer committed to diversity and inclusion.","description_format":"text","description_chars":7637,"description_truncated":false,"requirements":{"experience_years_min":8,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":null,"security_clearance":false,"languages":[]},"benefits":["Equity","Growth opportunities","Professional development"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Code Intelligence","AI Development Tools"],"lifecycle":[{"event":"open","at":"2026-11-05T07:43:52Z"}],"visa":[],"liveness":{"score":86,"band":"hot","label":"Hiring now","p_open":1,"p_active":0.86,"p_room":1,"age_days":0,"expected_fill_days":98,"reasons":["conf:2","win:early"],"computed_at":"2026-11-06T05:58:05Z"},"pay":null,"html_url":"https://alion.io/job/coderabbit-staff-security-engineer","json_url":"https://alion.io/job/coderabbit-staff-security-engineer.json","meta":{"generated_at":"2026-11-06T21:59:53Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":3211,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-11-07T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":35010},"rest":"https://alion.io/mcp/rest/get_company?id=35010"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fcoderabbit-staff-security-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fcoderabbit-staff-security-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fcoderabbit-staff-security-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/coderabbit-staff-security-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fcoderabbit-staff-security-engineer"}],"agent":{"mcp":"https://alion.io/mcp/jobs","mcp_open":"https://alion.io/mcp/open","next":[{"tool":"get_job","arguments":{"id":3793353}},{"tool":"search_jobs","arguments":{"company":"coderabbit.ai","detail":"compact"}},{"tool":"match_people","arguments":{"job_id":3793353},"note":"people open to offers who fit this vacancy"}],"note":"The same data through MCP tools: https://alion.io/mcp/open needs no sign-in (compact searches, postings, people); https://alion.io/mcp with an Alion account has everything. Docs: https://alion.io/developers"}}