Product Manager: Security

AI Chopping Block

India

On-site

INR 2,500,000 - 4,200,000

Full time

14 days+

Application generator

A complete application in a minute — tailored resume and cover letter, ready to send.

Get past ATS filters

Benefits offered by this job

Competitive salary

Equity

Benefits

Professional development opportunities

Job summary

CodeRabbit is hiring a strong Product Manager to own the security product: an AI-driven scanner that finds real vulnerabilities across codebases and surfaces findings in PR reviews. You will shape the product end to end, balancing precision and coverage, and engage with security buyers and engineering teams.

Ideal candidates have 5–8 years in security-focused PM or hands-on security roles, with experience in technical B2B software and familiarity with SAST, DAST, and IaC tooling.

Qualifications

5–8 years of security space experience in product management or hands-on security roles.
Experience with deeply technical products, ideally B2B SaaS or developer tools.
Practical knowledge of real vulnerability classes and exploit techniques.
Familiarity with SAST, DAST, secrets scanning, IaC, and software composition analysis.
Able to read code, understand APIs, and converse with engineers without a translator.
Strong written communication; PRDs and tickets that you’re proud of.
Comfort with ambiguity and high ownership mindset.

Responsibilities

Own the security product end to end: deep codebase scans and findings in PR reviews.
Define investment in vulnerability classes, scanner capabilities, and languages across security domains.
Set the product’s detection quality metrics: precision, recall, and acceptable noise.
Orchestrate how findings are presented, triaged, and remediated with feedback loops.
Collaborate with Sales and security buyers (AppSec, CISOs) for evaluations and positioning.

Skills

Security product management

Technical product management

Vulnerability knowledge

Security tooling awareness

Technical writing

Adaptability

Ownership mindset

Tools

Git platforms

Job description

About CodeRabbit

CodeRabbit is the leading AI code review platform, trusted by more than 17,000 customers and 150,000 open-source projects, conducting over 2 million code reviews each week. We build the symbiotic partnership between developers and AI that makes shipping fast software safe again, reviewing every pull request, IDE change, and CLI commit so teams can move quickly without breaking things.

We are a fast-moving, well-funded company, fresh off a $143M Series C at a $1.5B valuation — building Agentic Change Management, the control layer for software changes created by humans and agents. As AI writes more of the world's code, the bottleneck moves from implementation to judgment and helping human judgment scale is exactly the problem we exist to solve.

Role Overview

We're hiring a strong, hands‑on Product Manager to own CodeRabbit's security product: the AI‑driven scanner that hunts for real vulnerabilities across entire codebases and surfaces security findings directly in pull request reviews. The product combines LLM‑based vulnerability hunting with static analysis, secrets detection, infrastructure‑as‑code checks, and dependency and supply‑chain analysis, and grades every finding for exploitability and severity before a customer ever sees it.

This is a high‑ownership IC role.

One thing we're firm on: you must come from the security space

What You'll Own

Product Direction & Roadmap

Own the security product end to end: deep codebase scans, security findings in pull request reviews, and everything in between
Decide which vulnerability classes, scanner capabilities, and languages we invest in next across SAST, secrets detection, infrastructure‑as‑code misconfiguration, and dependency and supply‑chain analysis
Define what good detection means as a product: the precision, recall, and noise bar a finding must clear before a customer sees it

The Findings Experience

Own how findings are presented, triaged, and resolved: severity and exploitability grading, dismissal and feedback loops, remediation flows, and reporting
Treat every false positive as a trust problem, not a tuning detail — the goal is a scanner developers believe, not one they mute
Turn detection‑quality evidence (benchmarks, evaluations, real‑world results) into product decisions and customer‑facing proof

The Security Buyer

Own the AppSec and CISO persona alongside our developer users: what security teams need to evaluate, trust, and roll out the product across an organization
Partner with Sales on enterprise security evaluations and competitive positioning in the code security market
Shape pricing and packaging of the security offering with Growth and Finance

Detection Quality as a Product Metric

Work daily with the engineers building the agentic scanning pipeline; bring the customer and market view to detection priorities
Own the quality bar for what ships: hold detection changes to benchmark evidence, and make precision‑versus‑coverage tradeoffs deliberately rather than by default

Who You Are

5–8 years in the security space: product management at a security vendor, or hands‑on security work (application security, penetration testing, vulnerability research, detection engineering) that you carried into product. We're hiring security depth, not adjacent experience
Product management experience with deeply technical products, ideally at a B2B SaaS or developer tools company
Practical knowledge of real vulnerability classes and how they're exploited — enough to challenge a severity call, judge a disputed false positive, and hold your own with security engineers and customers' AppSec teams
You know the security tooling landscape (SAST, DAST, secrets scanning, IaC, software composition analysis) and exactly why developers distrust most of it
Technically fluent. You can read code, understand APIs, and have detailed conversations with engineers without a translator
You write well and communicate precisely. PRDs and tickets you've written are things you're proud of
Comfortable with ambiguity; can move from fuzzy problem to clear spec without hand‑holding
Low ego, high ownership. You care about the outcome more than the credit

Nice to Have

A hands‑on practitioner past: CVEs, bug bounty history, CTFs, or pentest findings with your name on them
Experience shipping products built on LLMs or agentic systems, or well‑formed judgment about where they help and where they fail
Direct vendor‑side experience in the code security market (SAST, ASPM, or software composition analysis)
Working knowledge of Git platforms (GitHub, GitLab, Bitbucket, ADO) as a power user or PM

What This Isn't

We'll be upfront: this isn't a compliance‑checkbox product, and it isn't a GTM‑only role. The hard problems here are detection quality, trust, and making security findings genuinely actionable for developers - deep, technical, judgment‑heavy product work in one of the fastest‑moving areas of AI.

What it is: one of the biggest product bets we're making. As AI writes more of the world's code, someone has to catch what it gets wrong, and we intend to be the ones developers and security teams both trust to do it.

Our Values

Collaborative Humans: Prioritizing collective intelligence

Fearless Innovators: Turning obstacles into growth opportunities

Persistent, Passionate Developers: Thriving on complex, long‑term challenges

Impact‑Driven Creators: Crafting intuitive tools for developers

Rapid Learners and Un‑learners: Adapting quickly in our fast‑paced technological world

What We Offer