Staff Security Engineer

Overview

Staff Security Engineer to set technical security direction and lead hands-on security work across CodeRabbit's products, cloud infrastructure, identities, and AI systems. Senior individual contributor role with company-wide influence.

What you'll do

• Define and drive the technical security roadmap with engineering leaders, prioritizing work by customer impact, threat exposure, and business needs; establish clear ownership and measure whether controls reduce risk.
• Lead threat modeling and security architecture reviews for products, infrastructure, and major design changes; build reusable patterns, guardrails, and automated checks.
• Improve cloud security across GCP, GKE/Kubernetes, and serverless workloads, covering network isolation, workload identity, secrets management, encryption and key management, container security, and infrastructure-as-code controls.
• Lead identity and access management improvements for people, services, and automation, including least privilege, SSO/MFA, privileged and time-bound access, service accounts, credential lifecycle management, access reviews, and joiner/mover/leaver controls; partner with IT and platform teams on implementation.
• Build and operate security detection capabilities using cloud audit logs, identity events, application telemetry, and endpoint signals; develop and test SIEM detections, tune alerts, investigate suspicious activity, and improve visibility into credential misuse and unauthorized access.
• Lead technical incident response for complex security events, from triage and investigation through containment, eradication, and recovery; maintain playbooks, run exercises, and drive root-cause fixes and post-incident improvements.
• Plan and execute authorized offensive assessments, red team exercises, and adversary emulation across applications, APIs, cloud, and enterprise environments; define scope and rules of engagement, validate impact safely, and turn findings into fixes and tested detections.
• Assess AI and agentic-system risks, including prompt injection, tool and connector abuse, excessive agent permissions, RAG/vector-store poisoning, sensitive-data leakage, and trust boundaries between models, tools, and workloads.
• Build security tooling and automation in Python, Go, or similar languages; integrate preventive controls and security testing into CI/CD and work with engineers to validate remediation.
• Improve vulnerability management and bug bounty or responsible disclosure triage, focusing on exploitability, remediation ownership, timelines, and recurring weaknesses.
• Mentor engineers, lead cross-team technical decisions, and communicate security tradeoffs clearly to engineering leaders and non-technical stakeholders; partner with compliance teams so documented controls reflect how systems actually operate.

What you'll need

• Typically 8+ years of relevant security engineering experience, or equivalent demonstrated depth and impact, with a track record of leading complex initiatives across teams as a senior technical individual contributor.
• Strong hands-on cloud and infrastructure security experience, including Kubernetes, networking, secrets and key management, and infrastructure as code.
• Deep expertise in at least one major cloud provider; GCP experience is particularly relevant.
• Practical IAM expertise across workforce and workload identities, including least-privilege design, federation, service accounts, privileged access, credential management, and investigation of identity-based attacks.
• Experience building and validating security detections, working with SIEM and cloud audit telemetry, and investigating incidents; ability to lead response under pressure and translate lessons into lasting engineering improvements.
• Strong application and offensive security skills, demonstrated through impactful internal findings, penetration tests, vulnerability research, responsible disclosures, bug bounty work, or security tooling.
• Strong programming and automation skills, with the ability to build maintainable tools and contribute directly to production code and infrastructure changes.
• Ability to reason through attack chains and system trust boundaries, use frameworks such as MITRE ATT&CK where useful, and balance preventive controls, detection, and response.
• Proven ability to navigate ambiguity, influence architecture without direct authority, mentor engineers, and deliver measurable improvements across organizational boundaries.
• Clear written and verbal communication, sound judgment, and the ability to explain risk and practical tradeoffs to technical and non-technical audiences.

Nice to have

• Experience securing AI/ML, LLM, RAG, or multi-agent systems, including OWASP guidance for LLM applications and AI red-team practices.
• Experience securing developer platforms, source-code integrations, CI/CD pipelines, software supply chains, and customer credentials or tokens.
• Experience with threat hunting, digital forensics, endpoint security, and detection-as-code workflows.
• Experience supporting SOC 2 or ISO 27001 controls through engineering automation and evidence collection.
• Contributions to security research, open-source tooling, responsible disclosure communities, or conference talks.
• Relevant practical certifications (a plus, not a substitute for demonstrated impact).

Details

• Location: Bengaluru.