Startups · updated daily
Code security startups hiring now
The code security startups hiring the most right now are Sonar, Chainguard and Endor Labs. 40% of their open roles are in engineering. 40% of these companies hire mostly remote. Most are based in San Francisco, Boston and Austin. Every role here comes from the company’s own careers page and is re-checked daily.
40%
of roles in engineering
22%
of roles in sales and gtm
8%
of roles in product and design
2%
of roles in people and finance
2%
of roles in data
Companies
Who is hiring
Sonar
Geneva, CH · Late Stage Venture
Sonar provides AI code verification and governance tools that ensure software generated by AI-assisted developers or autonomous agents is reliable, secure, and maintainable.
105 open roles10% remote
Chainguard
Kirkland, US · Series D
Chainguard provides hardened, secure, and production-ready builds of open source software. Its container catalog builds over 2,200 upstream projects into container images and maintains over 30,000 OS packages.
71 open roles100% remote
Endor Labs
Palo Alto, US · Series B
The platform uses reachability analysis to cut through noise and offers SAST, secrets detection, SCA, malicious package detection, AI governance, and container scanning.
31 open roles86% remote
Snyk
Boston, US · Series F
Snyk is a developer security platform that allows teams to scan, prioritize, and fix security vulnerabilities in code, open-source dependencies, container images, and infrastructure as code configurations.
16 open roles38% remote
HiddenLayer
Austin, US · Series A
HiddenLayer provides an AI security platform that unifies supply chain security, runtime defense, posture management, and automated red teaming to protect agentic, generative and predictive AI applications. Its Machine Learning Detection and Response (MLDR) product monitors inputs and outputs of AI algorithms to offer real-time defense and flexible response options.
16 open roles100% remote
depthfirst
San Francisco, US · Series B
The company’s AI-native security platform General Security Intelligence builds context on a company's code, infrastructure, and business logic to find complex vulnerabilities, focus on the important issues, and provide developers with ready-to-merge fixes.
16 open roles0% remote
Corridor
San Francisco, US · Series A
Corridor provides a security platform that integrates directly with AI coding tools and developer workflows to guide secure code generation in real time. It reviews code and pull requests to identify vulnerabilities, enforce security guardrails, and deliver actionable remediation guidance at the source.
14 open roles0% remote
Veracode
Burlington, US · Private Equity
Veracode is a multi-award-winning company offering capabilities to secure the entire software development life cycle, including Veracode Fix, Static Analysis, Dynamic Analysis, Software Composition Analysis, Container Security, Application Security Posture Management, Malicious Package Detection, and Penetration Testing.
12 open roles100% remote
Semgrep
San Francisco, US · Series D
Semgrep is an application security platform that provides static application security testing (SAST), software composition analysis (SCA), and secrets detection. It identifies vulnerabilities in source code without executing it.
10 open roles20% remote
Mend
Boston, US · Series E
Mend.io is the security platform built for every risk, across application security and AI security — securing the code layer, the AI layer, and the attack surface between them. Mend.io offers the first AI native application security platform, empowering organizations to build and run a proactive AppSec program tuned for AI powered development.
9 open roles78% remote
Legit Security
Tel Aviv, IL · Series B
Legit Security delivers an AI-native ASPM platform that automates AppSec issue discovery, prioritization, and remediation. The platform provides full management from AI-generated code to deployment, helping customers analyze their software risk, fix it with agents, and secure code during generation.
9 open roles11% remote
Bugcrowd
San Francisco, US · Late Stage Venture
The company offers Bug Bounty, Vulnerability Disclosure, Pen Testing as a Service, and Red Team as a Service programs.
8 open roles88% remote
Trail of Bits
New York, US · Bootstrapped
Provides application-security and cryptography services to organizations.
7 open roles100% remote
Kodem
Tel Aviv, IL · Series A
Kodem provides an application security platform that integrates SAST, SCA, Container Security, and ADR. It uses runtime intelligence to determine actual application risk and reduce false positives.
7 open roles0% remote
Apiiro
New York City, US · Series B
Apiiro is the Agentic AppSec Platform built to transform how development teams design, develop, and deliver secure software. Apiiro Guardian Agent prevents vulnerable and non-compliant code before it exists, protects coding agents from attacks, AutoFixes the backlog, and consolidates AppSec into a single control plane.
5 open roles
Cobalt
San Francisco, US · Series B
Customers can start a pentest in as little as 24 hours and integrate with development cycles.
4 open roles100% remote
Prime Security
Series A
Prime Security provides AI software that helps teams manage security throughout software development.
4 open roles
Aisle
San Francisco, US
The company's AI-native cyber reasoning system (CRS) finds vulnerabilities that are missed by older technologies and automatically creates ready-to-merge patches, reducing remediation time to days or minutes while maintaining human oversight.
3 open roles33% remote
Invicti
Austin, US · Private Equity
Invicti provides application security software to discover vulnerabilities across code, APIs, and web applications.
3 open roles
FOSSA
San Francisco, US · Series B
FOSSA is a leading SBOM and software supply chain risk management platform. It helps enterprises generate, ingest, analyze, and operationalize SBOMs in multiple formats. It also offers comprehensive SCA capabilities, including automated open source license compliance management and vulnerability prioritization solutions.
2 open roles
HACKUITY
Lyon, FR
Hackuity is a risk-based vulnerability management platform that helps cybersecurity teams identify, prioritize, and resolve vulnerabilities.
2 open roles
Inspectiv
Culver City, US · Series A
Inspectiv is an all-in-one application security testing platform that simplifies discovering, validating, and remediating vulnerabilities. It offers penetration testing, bug bounty programs, dynamic application security testing (DAST), and vulnerability disclosure in a single solution.
1 open roles
Corgea
San Francisco, US · Seed · YC S23
Corgea finds, and fixes insecure code and packages autonomously.
1 open roles
GitLab
San Francisco, US · Post Ipo
GitLab is the intelligent orchestration platform for DevSecOps. It provides a complete software development lifecycle toolchain including source control, CI/CD, security scanning, and project management in a single application.
205 open roles99% remote
Black Duck
Burlington, US · Private Equity
Black Duck provides application security testing solutions including SAST, SCA, and DAST. Its Black Duck Signal product is an agentic AI AppSec solution. The company serves Global 2000 enterprises across financial services, technology, healthcare, and government sectors.
38 open roles53% remote
Open roles
Newest roles at these startups
HiddenLayer
Remote, US- DC Metro Area
Director of Federal Sales
Remote, US- DC Metro Area
—
1d ago
Chainguard
New York - Remote
Senior Partner Manager - NY Metro
New York - Remote
$145k–$170k
1d ago
GitLab
Remote, United States
Strategic Account Executive - Chicago
Remote, United States
$115k–$172k
1d ago
GitLab
Remote, United States
Corporate Development Director
Remote, United States
$168k–$286k
1d ago
GitLab
Remote Ireland
Renewals Manager EMEA
Remote Ireland
—
1d ago
Endor Labs
Remote - US
Staff Product Security Engineer
Remote - US
—
2d ago
Sonar
Austin, Texas
Senior Revenue Accountant
Austin, Texas
—
2d ago
Bugcrowd
Huntsville, Alabama
Staff Software Engineer (Security Clearance Required)
Huntsville, Alabama
$151k–$189k
2d ago
What code security startups build
Companies working in code security. Sonar: Sonar provides AI code verification and governance tools that ensure software generated by AI-assisted developers or autonomous agents is reliable, secure, and maintainable. Chainguard: Chainguard provides hardened, secure, and production-ready builds of open source software. Its container catalog builds over 2,200 upstream projects into container images and maintains over 30,000 OS packages. Endor Labs: The platform uses reachability analysis to cut through noise and offers SAST, secrets detection, SCA, malicious package detection, AI governance, and container scanning.
The roles they hire for
Across the roles open today, the mix is engineering (40%), sales and gtm (22%), product and design (8%), people and finance (2%) and data (2%). Engineering roles here often ask for hands-on work with the product's hardest part, so a portfolio or a shipped project counts for more than a long resume.
How to get hired at code security startups
These teams hire fast and from their own careers pages, so the first applications get read first. Apply in the first day a role is up, tailor your resume to the role's own words, and answer the screening questions like you already work there. landed does all three for you: it watches every company on this page and applies the moment a fitting role goes up.
landed applies. You interview.
Let landed apply to code security for you
landed watches every company on this page and applies the moment a fitting role goes up, with a tailored resume and answers for the role. 25 free applications, no card.
Frequently asked
Which code security startups are hiring the most?
Right now: Sonar, Chainguard, Endor Labs, Snyk and HiddenLayer. The list above ranks every company by the roles it has open today.
Do code security startups hire remotely?
40% of the companies here hire mostly remote. Each company page shows its own remote share.
What roles do code security startups hire for?
The most common are engineering, sales and gtm and product and design.
Can landed apply to code security startups for me?
Yes. landed watches every company on this page, applies on each company’s own site the moment a fitting role goes up, and writes the answers for every role. Your first 25 applications are free.