Semgrep jobs, judged for you, free

What they do

Semgrep builds a code security platform. It finds and fixes security issues in code as developers write it, with AI that cuts false alarms. Products cover source code, open source dependencies, secrets, and AI-written code. Drew Dennison, Isaac Evans, and Luke O'Malley founded it in 2017. Figma, Dropbox, and Snowflake use it.

What they value

• Be audacious: look for what can go right, and chase big opportunities.
• Do it fast: move quickly and test ideas against reality often.
• Improve every day, and question old assumptions.
• Users are the judge of the value of the work.
• Embrace debate: challenge ideas without personal attacks.
• Be honest and humble, and lead by influence.

Where they hire

Most roles are hybrid, three or more days a week in the San Francisco, New York, Boston, or Denver offices. Engineering considers remote work for exceptional candidates. Two roles are remote in the US, in a set list of states, and one is remote in Asia-Pacific. Interns work in San Francisco five days a week. No Posting mentions visa sponsorship.

Teams and roles

The 11 open roles are in engineering and sales.

• Engineering: senior and staff backend engineers and a senior full-stack engineer. The stack is TypeScript and React, Python with Flask and SQLAlchemy, Kubernetes, and AWS.
• Engineering management: managers for software supply chain security and for Guardian, which checks AI-written code the moment an agent or IDE writes it.
• Security research: a senior or staff researcher who finds vulnerabilities and builds tools.
• Sales and field: a head of field engineering, a sales solutions engineer, a technical account manager for Asia-Pacific, and revenue operations.
• Internships: software engineer interns in San Francisco.

US pay ranges go from $152,000 to $288,000 base. Sales roles add commission.

What they look for

Most Postings ask for 3 to 8 or more years of experience in the field of the role. Customer-facing roles ask for excellent written and verbal communication and a deep understanding of developer workflows and CI/CD (automated build and deploy) tools. Engineering roles prefer the Semgrep stack but accept people who learn it quickly. Manager roles ask for coaching and mentoring skills. Many roles ask for interest in application security.