Security Engineer

About CodeRabbit CodeRabbit is an innovative research and development company focused on building extraordinarily productive human-machine collaboration systems. Our primary goal is to create the next generation of Gen AI-driven code reviewers: a symbiotic partnership between humans and advanced algorithms that significantly outperforms individual engineers. We combine language models with human ingenuity to push the boundaries of software development efficiency and quality. About the Role We're looking for a hardcore offensive security engineer/researcher to join our security team — someone who thinks like an attacker and builds like an engineer. You'll spend your time finding ways to break our own systems before anyone else does, then work directly with engineering to fix what you find. If you've disclosed vulnerabilities, hunted bug bounties, or get genuinely excited about a new CVE writeup, this role is built for you. What You'll Do Plan and execute scoped offensive security assessments, red team operations and adversary-emulation exercises across enterprise, application, cloud, and network environments — simulating real attacker behavior, not checklist-based audits Identify, exploit, and responsibly document vulnerabilities across web applications, APIs, network infrastructure, wireless, mobile, and cloud-native attack surfaces Assess AI and agentic-system attack surfaces, including prompt injection, tool/function-calling abuse, agent privilege boundaries, RAG/vector-store poisoning, model/system-prompt leakage, data exfiltration paths, and abuse of connectors or automation workflows. Develop and refine proof-of-concept exploits, custom tooling, and scripts (Python, Go, or similar) to support engagements and scale offensive capabilities Work as part of a team to explore systems methodically, taking time to avoid detection — the goal is reaching the objective quietly, not finding every possible vulnerability Turn findings into durable fixes: partner with enginee