Product Manager: Security

ABOUT CODERABBIT CodeRabbit is the leading AI code review platform, trusted by more than 17,000 customers and 150,000 open-source projects, conducting over 2 million code reviews each week. We build the symbiotic partnership between developers and AI that makes shipping fast software safe again, reviewing every pull request, IDE change, and CLI commit so teams can move quickly without breaking things.   We are a fast-moving, well-funded company, fresh off a $143M Series C at a $1.5B valuation — building Agentic Change Management, the control layer for software changes created by humans and agents. As AI writes more of the world's code, the bottleneck moves from implementation to judgment and helping human judgment scale is exactly the problem we exist to solve. ROLE OVERVIEW We're hiring a strong, hands-on Product Manager to own CodeRabbit's security product: the AI-driven scanner that hunts for real vulnerabilities across entire codebases and surfaces security findings directly in pull request reviews. The product combines LLM-based vulnerability hunting with static analysis, secrets detection, infrastructure-as-code checks, and dependency and supply-chain analysis, and grades every finding for exploitability and severity before a customer ever sees it. This is a high-ownership IC role. One thing we're firm on: you must come from the security space. This product lives or dies on security judgment - what a true positive looks like, what severity a finding deserves, and what an AppSec team actually needs before it will trust a scanner. WHAT YOU'LL OWN PRODUCT DIRECTION & ROADMAP - Own the security product end to end: deep codebase scans, security findings in pull request reviews, and everything in between - Decide which vulnerability classes, scanner capabilities, and languages we invest in next across SAST, secrets detection, infrastructure-as-code misconfiguration, and dependency and supply-chain analysis - Define what good detection means as a product: the precision, recall, and noise bar a finding must clear before a customer sees it THE FINDINGS EXPERIENCE - Own how findings are presented, triaged, and resolved: severity and exploitability grading, dismissal and feedback loops, remediation flows, and reporting - Treat every false positive as a trust problem, not a tuning detail — the goal is a scanner developers believe, not one they mute - Turn detection-quality evidence (benchmarks, evaluations, real-world results) into product decisions and customer-facing proof THE SECURITY BUYER - Own the AppSec and CISO persona alongside our developer users: what security teams need to evaluate, trust, and roll out the product across an organization - Partner with Sales on enterprise security evaluations and competitive positioning in the code security market - Shape pricing and packaging of the security offering with Growth and Finance DETECTION QUALITY AS A PRODUCT METRIC - Work daily with the engineers…