Staff Software Engineer, Security Factory: Static Analysis

Details

As a Staff Backend Engineer on GitLab's Security Factory: Code Scanning team, you will help developers find and fix security issues in the code they write. You will set the technical direction for the static analysis engine that identifies those issues.

The role covers program modeling and evaluation. On the engine side, you will work with parsing, intermediate representations, symbol resolution, call graphs, and taint tracking across files and languages. On the evaluation side, you will build tooling to test, measure, and validate engine results against benchmark applications with known vulnerabilities.

You will direct AI-assisted development using written specifications, ensuring that agent-written code and generated results meet quality, security, performance, API, and dependency requirements.

Responsibilities

• Act as the directly responsible individual for the team's highest-scope initiatives from design through delivery.
• Ship large features with minimal guidance and shape the team's long-range technical goals.
• Bring systems built by one engineer to team ownership through documentation, tests, and shared review.
• Set the technical direction for AI-assisted tooling that implements, reviews, and validates engine changes and findings.
• Design checks that determine whether agent-written changes and generated results are fit to merge.
• Measure detection quality against benchmark applications with known vulnerabilities, including SAST rules mapped to CWE and OWASP and the test fixtures that validate them.
• Own the architecture of the program model, including parsing, symbol resolution, intermediate representations, call graphs, taint analysis, and data-flow analysis.
• Own the pipeline that turns source code into findings and define how the system extends to new languages and frameworks.
• Solve high-scope technical problems and address team-wide impediments.
• Advocate for improvements to quality, security, and performance with Product Management, UX, Code Security, Composition Analysis, and partner teams.
• Mentor engineers through code review and pairing, remove blockers to autonomy, and improve internal standards.
• Participate in on-call rotations supporting product operations, security operations, and urgent engineering issues.
• Define overarching architecture and specification documents, delegate component specifications to engineers and AI agents, and drive implementation through phased plans and small, reviewable changes.
• Build and maintain the harness, agent instructions, and agentic skills that keep agent-written code trustworthy.
• Maintain separate coding and reviewing agents, immutable rules and tests, independent review panels using agents from different model providers, and performance, API, and dependency gates.
• Escalate risky changes to human review.
• Stay current with program analysis and security research, conduct AI-assisted research and spikes, and turn findings into prototypes, proposals, and upstream contributions, including responsible disclosure in open-source projects.

Requirements

• Experience building LLM tooling, such as a harness, agent pipeline, or evaluation system, with the judgment to assess when output is trustworthy.
• Extensive professional experience writing, testing, and reviewing production code in Rust, Go, or a comparable systems language, with depth in at least one.
• Willingness to work across Rust, Go, and Ruby. The engine is written in Rust, the analyzer wrapper in Go, and monolith integration in Ruby.
• Experience with performance optimization, containerized workflows, and CI/CD. GitLab uses Docker extensively.
• Deep program analysis and static analysis experience, including areas such as parsing and ASTs, intermediate representations, SSA, control-flow and call graphs, taint and data-flow analysis, type inference, incremental and fixpoint computation, or detection rules.
• Ability to read, evaluate, and apply research literature.
• Deep application security experience, such as vulnerability research, secure code review, or writing detection rules.
• Fluency with vulnerability classes including OWASP Top 10 and CWE.
• Ability to communicate clearly and concisely about complex technical, architectural, and organizational problems.
• Experience writing architecture and design specifications that enable teams to reach decisions.
• Track record of taking ownership of ambiguous, team-wide problems and shipping them from concept to production with minimal guidance.
• Experience providing regular asynchronous updates about progress, blockers, risks, and next steps.
• Experience defining overarching system architecture, delegating component specifications to engineers and AI agents, and getting them implemented reliably.
• Track record of mentoring engineers, raising a team's technical bar, and influencing technical direction through consensus with peers and leadership.

Helpful Experience

• Familiarity with popular web or mobile application frameworks and how they handle input, data, and configuration.
• Experience designing guardrails for agent-written code, such as mutation testing, fuzzing, and CI gates that coding agents cannot modify.
• Engagement with the research community through publications, tool papers, or upstream open-source contributions in program analysis or security.

Team

The Security Factory: Code Scanning team develops GitLab's SAST capabilities for customer software repositories. The team works closely with Code Security on scanning rules and flows, Composition Analysis on the broader software supply chain, and other groups across the Sec Section. The team relies heavily on asynchronous work across time zones.

Benefits

• Benefits supporting health, finances, and well-being.
• Flexible paid time off.
• Team Member Resource Groups.
• Equity compensation and Employee Stock Purchase Plan.
• Growth and Development Fund.
• Parental Leave.
• Equal opportunity workplace with accommodations available during the recruiting process.

The base salary range for residents of the United States is $152,800–$259,200 USD. This range excludes bonuses, equity, and benefits. GitLab roles are remote, although some roles may have location-based eligibility requirements.