About CodeRabbit

CodeRabbit is the governance and control layer for agentic software development, helping engineering teams trust the code they ship. AI can generate code faster than people can review and understand it. Teams still need to know whether each change solves the right problem, fits their architecture, and is safe to ship.

We provide independent validation grounded in codebase context and team standards, giving people the evidence they need to judge what should ship. Across Review, Triage, Explain, and Secure, our platform challenges changes before merge, prioritizes pull requests by value, impact, and risk, explains what changed and why it matters, and monitors the codebase for security vulnerabilities after merge.

CodeRabbit serves nearly 20,000 customers and supports approximately 300,000 open-source repositories, performing over 2 million code reviews each week. Our $143M Series C, raised at a $1.5B valuation, supports further product development and international expansion.

Role Overview

We're hiring a strong, hands-on Product Manager to own CodeRabbit's security product: the AI-driven scanner that hunts for real vulnerabilities across entire codebases and surfaces security findings directly in pull request reviews. The product combines LLM-based vulnerability hunting with static analysis, secrets detection, infrastructure-as-code checks, and dependency and supply-chain analysis, and grades every finding for exploitability and severity before a customer ever sees it.

This is a high-ownership IC role.

One thing we're firm on: you must come from the security space. This product lives or dies on security judgment - what a true positive looks like, what severity a finding deserves, and what an AppSec team actually needs before it will trust a scanner.

What You'll Own

Product Direction & Roadmap

Own the security product end to end: deep codebase scans, security findings in pull request reviews, and everything in between

Decide which vulnerability classes, scanner capabilities, and languages we invest in next across SAST, secrets detection, infrastructure-as-code misconfiguration, and dependency and supply-chain analysis

Define what good detection means as a product: the precision, recall, and noise bar a finding must clear before a customer sees it

The Findings Experience

Own how findings are presented, triaged, and resolved: severity and exploitability grading, dismissal and feedback loops, remediation flows, and reporting

Treat every false positive as a trust problem, not a tuning detail — the goal is a scanner developers believe, not one they mute

Turn detection-quality evidence (benchmarks, evaluations, real-world results) into product decisions and customer-facing proof

The Security Buyer

Own the AppSec and CISO persona alongside our developer users: what security teams need to evaluate, trust, and roll out the product across an organization

Partner with Sales on enterprise security evaluations and competitive positioning in the code security market

Shape pricing and packaging of the security offering with Growth and Finance

Detection Quality as a Product Metric

Work daily with the engineers building the agentic scanning pipeline; bring the customer and market view to detection priorities

Own the quality bar for what ships: hold detection changes to benchmark evidence, and make precision-versus-coverage tradeoffs deliberately rather than by default

Who You Are

5–8 years in the security space: product management at a security vendor, or hands-on security work (application security, penetration testing, vulnerability research, detection engineering) that you carried into product. We're hiring security depth, not adjacent experience

Product management experience with deeply technical products, ideally at a B2B SaaS or developer tools company

Practical knowledge of real vulnerability classes and how they're exploited — enough to challenge a severity call, judge a disputed false positive, and hold your own with security engineers and customers' AppSec teams