# Security Engineer at Greptile > Onsite · United States · Unspecified · Security · open. Source: https://alderhq.app/jobs/ashby%3Agreptile%3A1995303e-eaed-4081-8dc4-9c59c18c8335 (read 2026-11-07). ## Facts (observed) - Company: [Greptile](https://alderhq.app/companies/greptile) - Location text: San Francisco - Where it can be done from (inferred): Onsite · United States (evidence: "Location: San Francisco") - Posted: 2026-10-21 (16 days ago) - First seen by alder: 2026-11-02 · last verified: 2026-11-04 - Reposted: 0 times · edited: 0 times - Apply on the employer's site: https://jobs.ashbyhq.com/greptile/1995303e-eaed-4081-8dc4-9c59c18c8335 - Skills listed (inferred): TypeScript, JavaScript, Figma ## Pay and sponsorship - Posted pay: $170k–$300k per year (from the listing's pay field) - Market band for similar posted roles (SF Bay Area, n 137): p25 $175k, median $219k, p75 $269k ## Description (the employer's text) ### Security Engineer We want to build agents that autonomously validate code changes. Today that looks like AI that reviews pull requests in GitHub, catching bugs and enforcing standards. Greptile reviews 5B lines of code every month for 22,000+ customers. Own Greptile’s security posture across the product, infrastructure, and internal systems. We’re looking for a hands-on Security Engineer to conduct penetration testing, triage bug-bounty reports, remediate vulnerabilities, and harden Greptile’s infrastructure. You’ll work directly with engineers on secure product and infrastructure improvements and critical architecture decisions. ### Problems we’re excited about Coding standards can be idiosyncratic and are often poorly documented; can we build agents that learn them through osmosis like a new hire might? Can we identify for each customer what types of PR feedback they do and don’t care about in order to increase signal-to-noise ratio? Some bugs are best caught by running the code. Can we autonomously deploy feature branches and use agents to try to break the application? How do we secure a product that processes highly sensitive code across cloud, self-hosted, and air-gapped environments? ### Trajectory 22,000+ customers 5B lines of code reviewed every month Scaled from $0 to eight figures in ARR Raised $80M from Menlo Ventures, Benchmark, Y Combinator, and Initialized ### Team We have assembled a small, talent dense team who have scaled critical functions at companies like Stripe, Google, Figma, etc. ### Responsibilities Own Greptile’s security posture across the product, infrastructure, and internal systems. Consult on risky code changes and critical architecture decisions. Conduct penetration tests, fix pentest findings and patch reported vulnerabilities. Manage our bug bounty program, triage incoming reports, and coordinate vulnerability response. Harden Greptile’s infrastructure and internal systems. Design, implement, test, and deploy secure product and infrastructure improvements. Work directly with engineers to make security part of how we build, rather than a final review step. ### Qualifications B.S. Computer Science or equivalent degree, undergraduate or higher 3+ years of software engineering, DevOps, or security engineering experience Experience with JavaScript/TypeScript Deep knowledge of application, infrastructure, and cloud security Experience working on security-critical products and complex architectures Strong judgment when evaluating vulnerabilities, technical tradeoffs, and risk ### You will like this role if You want to work on a product that thousands of developers rely on You want real ownership over the security of a fast-growing technical product The chaos of high growth and things breaking is exciting to you You like being in an office every day around other smart people who are excited about what they’re building You love solving very hard problems. You specifically prefer working in-person over working remote --- Data: alder (https://alderhq.app). Cite https://alderhq.app/jobs/ashby%3Agreptile%3A1995303e-eaed-4081-8dc4-9c59c18c8335 and the date you read it. Observed facts come from the employer's own listing; location reach, level, family and skills are inferences.