Senior Software Engineer, Security Factory: Code Security

Details

GitLab is an intelligent orchestration platform for DevSecOps. The Security Factory: Code Security team helps developers find and fix security issues in the code they write and in the open source components they depend on.

The role spans dependency analysis and vulnerability detection. Responsibilities include parsing dependency manifests, lockfiles, and SBOMs; extending automated dependency remediation; building hybrid analyzers that combine rule-based detection with AI reasoning; and developing tooling to evaluate and ship those analyzers. The team uses AI-assisted development tools in daily work and expects them to be used effectively and with good judgment.

Responsibilities

• Act as the directly responsible individual for team initiatives from design through delivery, shipping with minimal guidance in partnership with the technical lead.
• Bring systems built by one engineer to team ownership through documentation, tests, and shared review.
• Design and ship analyzers that combine deterministic analysis with AI-driven analysis.
• Build evaluation harnesses to measure false positives and missed findings against benchmark applications with known vulnerabilities, including detection rules mapped to CWE and supporting test fixtures.
• Package analyzers for GitLab CI jobs, AI agent workflows, and command-line tools, with findings reported in GitLab's standard security report formats.
• Design and ship manifest, lockfile, and SBOM parsing for static analysis, extending support to new ecosystems and formats.
• Extend the automated remediation service that turns security advisories into dependency update merge requests, including sandboxed updates and merge request creation.
• Solve high-scope technical problems and advocate for improvements to quality, security, and performance with Product Management, Frontend, UX, Code Scanning, Composition Analysis, and other partner teams.
• Mentor Intermediate engineers through code review and pairing, and maintain standards for style, maintainability, and best practices.
• Participate in on-call rotations to assist with product operations, security operations, and urgent engineering issues.

Requirements

• Experience building LLM tooling, such as a harness, agent pipeline, or evaluation system, with the judgment to assess when output is trustworthy.
• Substantial professional experience writing and testing production code in a systems language, particularly Go and/or Rust, with depth in at least one. GitLab also uses Ruby for remediation and Python for some analyzers.
• Familiarity with package managers and dependency management in one or more ecosystems, such as npm, Maven, pip, Bundler, or Cargo. Experience building tooling around them is preferred.
• Demonstrated application security experience, such as vulnerability research, secure code review, or writing detection rules.
• Fluency with vulnerability classes, including the OWASP Top 10 and CWE, and with the software supply chain.
• Experience taking ownership of ambiguous problems and shipping with minimal guidance in a remote, largely asynchronous environment.
• Ability to communicate clearly and concisely about technical problems and write design proposals that guide teams to decisions.

Helpful Experience

• Evaluating AI-driven detection against labeled data, including measuring false positives and missed findings.
• Performance optimization at scale.
• Program analysis, such as parsing, abstract syntax trees, or data-flow analysis.
• Familiarity with popular web or mobile application frameworks and how they handle input, data, and configuration.
• Containerized workflows and CI/CD; GitLab uses Docker heavily.

About the Team

The Security Factory: Code Security team builds GitLab's code-level security scanning capabilities, spanning static application security testing and dependency scanning. The team works closely with Static Analysis on GitLab's SAST engines, Composition Analysis on the broader software supply chain, and other groups across the Sec Section. The team relies heavily on asynchronous work across time zones.

Compensation

The United States base salary range is $139,200–$235,200 USD. This range applies to United States residents and excludes bonuses, equity, and benefits. GitLab provides benefits, flexible paid time off, equity compensation, an employee stock purchase plan, a growth and development fund, parental leave, and team member resource groups.

GitLab is a remote employer and hires in countries around the world, subject to location-based eligibility requirements. GitLab is an equal opportunity workplace and provides reasonable accommodations during the recruiting process.