Lead Security Engineer

CodeRabbit • San Francisco, CA

3d • Hybrid

About The Position

CodeRabbit is an innovative research and development company focused on building extraordinarily productive human-machine collaboration systems. Our primary goal is to create the next generation of Gen AI-driven code reviewers: a symbiotic partnership between humans and advanced algorithms that significantly outperforms individual engineers. We combine language models with human ingenuity to push the boundaries of software development efficiency and quality.
Role Overview:
CodeRabbit is on a mission to empower developers with lean, high-performance tools—they move fast, and so do the threats. That's why we're looking for a battle-tested Lead Security Engineer who’s been in the trenches and can architect, harden, and defend our infrastructure, tooling, and ecosystem.
As our Lead Security Engineer, you’ll lead security engineering at CodeRabbit, infusing security into every layer of our product and infrastructure. You become the steward of resilience, incident response, and proactive defense at scale.

Requirements

• Battle-tested experience: 8+ years in security engineering, incident response, or correlated fields—bonus if you've led through a major production breach or targeted attack.
• Technical depth: Extensive experience with security across software and infrastructure—threat modeling, pen testing, secure CI/CD pipelines, cloud security, incident response.
• Strategic mindset: Ability to translate risk into actionables, communicate trade‑offs with engineering/product leadership.
• Praxis over theory: You’ve taken production systems down (intentionally or unintentionally) and built them back stronger.
• Security in chaos: Experience in pressure situations—with clarity, direction, and calm.
• Developer‑centric approach: You can speak fluent dev-tools, empathize with fast-moving teams, and secure them without slowing them down.

Nice To Haves

• You’ve implemented DevSecOps tooling and orchestrated shift‑left security in developer pipelines.
• You’ve recovered from (or prevented) a critical security event, and turned that into an engineering culture improvement.
• Experience in a dev‑tools, SDK, or platform-heavy company.
• Hacker mindset + operational discipline - pentests, disaster recovery, threat hunting, tooling, cloud environments.
• Certifications like CISSP, CISM, CEH, or relevant cloud security certs.

Responsibilities

• Own the security roadmap — craft and execute a strategic security engineering plan that aligns with CodeRabbit’s fast-paced engineering cadence.
• Boost resilience — champion defense-in-depth tactics: threat modeling, secure design reviews, hardening, CI/CD integration.
• Be Incident Commander — spearhead security incident response and recovery: triage, resolve, root cause, and turn those learnings into stronger systems.
• Tools & automation — build or integrate security tooling (SAST, DAST, SIEM, EDR, monitoring) into the developer workflow without slowing delivery.
• Embed security fluently — partner with engineering and product teams to bring secure practices early into planning and daily workflows.
• Talent & culture — help to hire, coach, and mentor a scrappy, resilient security engineering team; elevate security awareness across the company.
• Compliance & policy — establish security standards, frameworks, or processes that evolve as we scale—but remain lean and developer-friendly.

Benefits

• Defend a Developer-First Future: At CodeRabbit, you’re not just protecting infrastructure—you’re securing the next evolution of developer tools. Help fortify a product that’s reshaping how code gets reviewed.
• Real Authority & Ownership: You won’t be on the sidelines. As Lead Security Engineer, you’ll define the security roadmap, lead critical incident responses, and gain full ownership of outcomes—from threat modeling to hardened deployment.
• Impact at Velocity: Join an agile, cross-functional squad of engineers, designers, and researchers. You’ll move fast but not recklessly - embedding security in every release without slowing delivery.
• Build, Break, Rebuild Stronger: Ideal for someone battle-tested; someone who's faced breaches, recovered systems, and evolved engineering culture through adversity.
• Grow and Lead: We're investing in you. This role offers ongoing leadership development, mentorship opportunities, and real ownership as you eventually scale your team and operations.
• Compensation That Reflects Responsibility: We deliver a competitive package—salary, equity, and benefits—to match the importance and intensity of this role.
• Hybrid Culture That Adapts to You: We collaborate in person in the Bay Area every week, but leave room for remote heads-down focus. It’s security, not surveillance.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed
• Number of Employees: 101-250 employees