Threat Research Engineer, Security Factory: Threat Research

Details

GitLab is an intelligent orchestration platform for DevSecOps. The Threat Research group researches emerging security threats and turns findings into protection for GitLab customers. The team maintains the GitLab Advisory Database, builds detection capabilities, conducts original vulnerability research, and publishes security findings.

Responsibilities

• Research new attack surfaces and threat vectors, including AI coding agents, agent plugins, and package ecosystems.
• Find and responsibly disclose vulnerabilities in open source projects and developer tools.
• Analyze software supply chain incidents and events.
• Build AI-powered workflows and agents that automate research, analysis, and detection.
• Build and maintain the cloud-based systems behind detection and advisory work.
• Improve the quality and coverage of vulnerability and malware advisories.
• Write findings as blog posts and present them at conferences.
• Participate in on-call or operational support where required by the team's ownership model.

Requirements

• Hands-on security experience in research, malware analysis, penetration testing, or security tooling, with both a developer and adversarial mindset.
• Demonstrated experience using AI in real work, such as building with large language model APIs or agent frameworks including LangChain, LangGraph, or agent SDKs.
• Strong programming skills in Go or Python.
• Good software engineering practices, including testing, code review, continuous integration and continuous delivery, and maintainable code.
• Experience deploying and running production services on a public cloud.
• Understanding of package ecosystems and software supply chain attacks.
• Ability to map attack vectors, identify trade-offs, and make data-driven decisions while balancing quality, speed, and customer outcomes.
• Ability to keep up with security and AI industry trends.
• Clear writing skills for explaining findings to engineers and general audiences.
• Helpful, but not required: published vulnerability findings; security research on AI agents, large language model applications, or Model Context Protocol servers; Google Cloud Platform experience; or infrastructure as code experience with Terraform or OpenTofu.
• Deep knowledge of compilers or static application security testing engines is not required; a high-level understanding is sufficient.

The role is full-time and remote. GitLab welcomes candidates with varying levels of experience and evaluates grade level and salary based on interviews, education, experience, skills, market data, geographic location, and applicable collective agreements.

Benefits

• Benefits supporting health, finances, and well-being.
• Flexible paid time off.
• Team member resource groups.
• Equity compensation and employee stock purchase plan.
• Growth and development fund.
• Parental leave.