GitLab

GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50 million registered users and more than 50% of the Fortune 100* trust GitLab to ship better, more secure software faster. The same principles built into our products are reflected in how our team works: we embrace AI as a core productivity multiplier, with all team members expected to incorporate AI into their daily workflows to drive efficiency, innovation, and impact. GitLab is where careers accelerate, innovation flourishes, and every voice is valued. Our high-performance culture is driven by our values and continuous knowledge exchange, enabling our team members to reach their full potential while collaborating with industry leaders to solve complex problems. Co-create the future with us as we build technology that transforms how the world develops software. *Fortune 500® is a registered trademark of Fortune Media IP Limited, used under license. Claim based on GitLab data. Fortune 100 refers to the top 20% ranked companies in the 2025 Fortune 500 list, published in June 2025. Fortune and Fortune Media IP Limited are not affiliated with, and do not endorse products or services of GitLab. An overview of this role As an Engineering Manager, you’ll guide GitLab’s dedicated Software Supply Chain Security (SSCS) Add-On engineering team as it develops core capabilities including Dependency Firewall, Build Provenance, Malicious Packages detection, and Artifact Signing. This is a founding management role where you’ll help shape how the team works, partner closely with the Staff Backend Engineer, Product Manager, and SSCS stage management, and turn a defined roadmap into steady, high-quality delivery for enterprise customers with strict security and compliance needs. You’ll focus on developing the team, creating a healthy operating rhythm, and establishing predictable execution for the SSCS SKU. You’ll join a product area where customers in regulated industries are already validating the need, and your work will help GitLab deliver software supply chain security features that customers can rely on. While technical credibility matters, your main focus will be growing a strong backend engineering team, enabling team members in their development, and creating the conditions for long-term delivery and quality. What you’ll do • Guide a backend engineering team building the SSCS Add-On across dependency enforcement, build provenance, malicious package detection, and artifact signing. • Be responsible for Drive engineering delivery for general availability milestones by aligning sequencing, scope, and dependencies with the Staff Backend Engineer and Product Manager. • Develop the team by partnering with Talent Acquisition on sourcing, interview design, candidate evaluation, and hiring decisions. • Run regular 1:1s, performance reviews, and career development conversations that enable growth and clear expectations. • Advance engineering quality by monitoring cycle time, defect rates, and test coverage, and by addressing risks early. • Coordinate quarterly planning and roadmap tradeoff discussions with SSCS stage leadership and Product. • Work with Finance and other partners on headcount pacing and team planning as the Add-On scales. • Represent the SSCS Add-On team within stage leadership discussions and help ensure strong communication across functions. What you’ll bring • Over 3 years of experience guiding backend product engineering teams in security, DevOps, or platform engineering environments. • Ability to hire and grow backend or security engineers in distributed team environments, with practical understanding of the talent landscape for these roles. • Technical credibility to contribute to architecture discussions involving package registries, CI/CD pipeline security, and signing infrastructure. • Experience managing predictable delivery across multi-quarter product roadmaps and managing cross-team dependencies. • Comfort working in an asynchronous, documentation-driven organization with clear written communication. • Familiarity with supply chain security, artifact management, or compliance-focused product areas, or transferable experience from related domains. • Working knowledge of concepts related to frameworks and ecosystems such as SLSA and Sigstore. • Ability to build credibility with engineers, product partners, and customer-facing stakeholders through clear judgment, coaching, and teamwork. About the team The SSCS Add-On team is a product engineering team within GitLab’s Software Supply Chain Security stage. We work on key capabilities in the SSCS Add-On SKU and collaborate closely with product and engineering partners to deliver security features for customers operating in regulated environments. You’ll report to the SSCS Senior Engineering Manager and partner directly with the Staff Backend Engineer and Product Manager. As a distributed team working asynchronously across regions, we are focused on strong delivery practices, team health, and scaling the product area with clarity and accountability. For more on how related teams work, see Team Handbook Page. How GitLab Supports Full-Time Employees • Benefits to support your health, finances, and well-being • Flexible Paid Time Off • Team Member Resource Groups • Equity Compensation & Employee Stock Purchase Plan • Growth and Development Fund • Parental Leave Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement. Additionally, studies have shown that people from underrepresented groups are less likely to apply to a job unless they meet every single qualification. If you're excited about this role, please apply and allow our recruiters to assess your application. Country Hiring Guidelines: GitLab hires new team members in countries around the world. All of our roles are remote, however some roles may carry specific location-based eligibility requirements. Our Talent Acquisition team can help answer any questions about location after starting the recruiting process. Privacy Policy: Please review our Recruitment Privacy Policy. Your privacy is important to us. GitLab is proud to be an equal opportunity workplace and is an affirmative action employer. GitLab’s policies and practices relating to recruitment, employment, career development and advancement, promotion, and retirement are based solely on merit, regardless of race, color, religion, ancestry, sex (including pregnancy, lactation, sexual orientation, gender identity, or gender expression), national origin, age, citizenship, marital status, mental or physical disability, genetic information (including family medical history), discharge status from the military, protected veteran status (which includes disabled veterans, recently separated veterans, active duty wartime or campaign badge veterans, and Armed Forces service medal veterans), or any other basis protected by law. GitLab will not tolerate discrimination or harassment based on any of these characteristics. See also GitLab’s EEO Policy and EEO is the Law. If you have a disability or special need that requires accommodation, please let us know during the recruiting process.

GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50 million registered users and more than 50% of the Fortune 100* trust GitLab to ship better, more secure software faster. The same principles built into our products are reflected in how our team works: we embrace AI as a core productivity multiplier, with all team members expected to incorporate AI into their daily workflows to drive efficiency, innovation, and impact. GitLab is where careers accelerate, innovation flourishes, and every voice is valued. Our high-performance culture is driven by our values and continuous knowledge exchange, enabling our team members to reach their full potential while collaborating with industry leaders to solve complex problems. Co-create the future with us as we build technology that transforms how the world develops software. *Fortune 500® is a registered trademark of Fortune Media IP Limited, used under license. Claim based on GitLab data. Fortune 100 refers to the top 20% ranked companies in the 2025 Fortune 500 list, published in June 2025. Fortune and Fortune Media IP Limited are not affiliated with, and do not endorse products or services of GitLab. An overview of the role We are seeking a Principal Security Researcher to join our Application Security Team to conduct cutting-edge security research on GitLab's AI-powered DevSecOps capabilities. As GitLab transforms software development through intelligent collaboration between developers and specialized AI agents, we need security researchers who can proactively identify and validate vulnerabilities before they impact our platform or customers. In this role, you'll be at the forefront of security research, working with our GitLab DevSecOps platform, Duo Agent Platform, GitLab Duo Chat, and AI workflows that represent the future of human/AI collaborative development. You'll develop novel testing methodologies (including for AI agent security), conduct hands-on penetration testing, and translate emerging threats into actionable security improvements. Your research will directly influence how we build and secure the next generation of AI-powered DevSecOps tools, ensuring GitLab remains the most secure software factory platform on the market. This position offers the unique opportunity to shape security and AI security practices in one of the world's largest DevSecOps platforms, working with engineering teams who are pushing the boundaries of what's possible with AI-assisted software development. You'll have access to cutting-edge AI systems and the freedom to explore creative attack scenarios while contributing to the security of millions of developers worldwide. This role reports to the Senior Manager of Application Security. What you'll do • Conduct and lead security research projects across multiple functional areas. • Identify novel, systemic, and chained vulnerabilities in GitLab, where individual weaknesses combine for outsized impact. • Validate security vulnerabilities through hands-on testing, developing proof-of-concept exploits that demonstrate real-world attack scenarios. • Assess emerging industry vulnerability classes against the GitLab codebase, and drive remediation of the class rather than the instance. • Lead security research into GitLab's AI and agentic surfaces, and define the security requirements that engineering teams build against. • Build and direct the tooling and automation that scales security research, including agent-assisted vulnerability discovery across our codebase. • Research the security posture of open source tools and dependencies integrated with GitLab, report findings to their maintainers, and track mitigation following our responsible disclosure guidelines. • Solve technical problems of the highest scope, complexity, and ambiguity. • Help shape the team and sub-department roadmap. • Lead the integration of security research results into the engineering and business functions that need to act on them. • Teach, mentor, and advise other domain experts and individual contributors across several teams. • Share knowledge and novel vulnerability types with the security community. What you'll bring • 10+ years of experience in security research, penetration testing, or offensive security roles • Strong ability in discovering and exploiting vulnerabilities in large codebase and complex systems • Proficiency in two or more of Ruby, Go, Python, TypeScript, or Rust. • Ability to read and analyze code across multiple languages and codebases • Strong knowledge of AI frameworks • Strong understanding of AI attack vectors including prompt injection, agent manipulation, and workflow exploitation • At ease in establishing and driving complex remediation initiatives involving cross-functional teams • Excellent written communication skills with an ability to articulate complex topics in a clear and concise manner. • Ability to translate complex technical findings into clear risk assessments and remediation recommendations • Strong analytical and problem-solving skills with creative thinking about attack scenarios • Nice to Have: Published security research or conference presentations; background in software engineering with distributed systems expertise; experience with GitLab or similar DevSecOps platforms About the team Security Researchers are a part of our Application Security team, who address complex security challenges facing GitLab and its customers to enable GitLab to be the most secure software factory platform on the market. We focus on systemic product security risks and work cross-functionally to mitigate them while maintaining Engineering's development velocity. The base salary range for this role’s listed level is currently for residents of the United States only. This range is intended to reflect the role's base salary rate in locations throughout the US. Grade level and salary ranges are determined through interviews and a review of education, experience, knowledge, skills, abilities of the applicant, equity with other team members, alignment with market data, and geographic location. The base salary range does not include any bonuses, equity, or benefits. See more information on our benefits and equity. Sales roles are also eligible for incentive pay targeted at up to 100% of the offered base salary. United States Salary Range $203,200—$275,000 USD How GitLab Supports Full-Time Employees • Benefits to support your health, finances, and well-being • Flexible Paid Time Off • Team Member Resource Groups • Equity Compensation & Employee Stock Purchase Plan • Growth and Development Fund • Parental Leave Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement. Additionally, studies have shown that people from underrepresented groups are less likely to apply to a job unless they meet every single qualification. If you're excited about this role, please apply and allow our recruiters to assess your application. Country Hiring Guidelines: GitLab hires new team members in countries around the world. All of our roles are remote, however some roles may carry specific location-based eligibility requirements. Our Talent Acquisition team can help answer any questions about location after starting the recruiting process. Privacy Policy: Please review our Recruitment Privacy Policy. Your privacy is important to us. GitLab is proud to be an equal opportunity workplace and is an affirmative action employer. GitLab’s policies and practices relating to recruitment, employment, career development and advancement, promotion, and retirement are based solely on merit, regardless of race, color, religion, ancestry, sex (including pregnancy, lactation, sexual orientation, gender identity, or gender expression), national origin, age, citizenship, marital status, mental or physical disability, genetic information (including family medical history), discharge status from the military, protected veteran status (which includes disabled veterans, recently separated veterans, active duty wartime or campaign badge veterans, and Armed Forces service medal veterans), or any other basis protected by law. GitLab will not tolerate discrimination or harassment based on any of these characteristics. See also GitLab’s EEO Policy and EEO is the Law. If you have a disability or special need that requires accommodation, please let us know during the recruiting process.

GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50 million registered users and more than 50% of the Fortune 100* trust GitLab to ship better, more secure software faster. The same principles built into our products are reflected in how our team works: we embrace AI as a core productivity multiplier, with all team members expected to incorporate AI into their daily workflows to drive efficiency, innovation, and impact. GitLab is where careers accelerate, innovation flourishes, and every voice is valued. Our high-performance culture is driven by our values and continuous knowledge exchange, enabling our team members to reach their full potential while collaborating with industry leaders to solve complex problems. Co-create the future with us as we build technology that transforms how the world develops software. *Fortune 500® is a registered trademark of Fortune Media IP Limited, used under license. Claim based on GitLab data. Fortune 100 refers to the top 20% ranked companies in the 2025 Fortune 500 list, published in June 2025. Fortune and Fortune Media IP Limited are not affiliated with, and do not endorse products or services of GitLab. An overview of this role As the Corporate Development Director, you'll help influence how GitLab invests to win: what we build, what we buy, where we partner, and what we should not pursue. This role sits within the Corporate Development & Strategic Partnerships team, reporting to the VP, Corporate Development & Strategic Partnerships. This role straddles strategy and M&A engagements. You'll lead research that frames GitLab's options: mapping the markets in and around our AI-powered DevSecOps platform, testing where we have a right to win, and turning that into clear recommendations for the executive team. When the answer is to acquire, you'll drive the deal process end to end, from outreach through close and integration. Success here is not measured by deal count. It looks like sharper strategic choices: a well-reasoned point of view on our priority markets, investment theses that product and executive leaders rely on, acquisitions that speed up the roadmap when buying is the right answer, and an educated no when it isn't. You'll own the wider market perspective rather than individual product categories, and work with the team's Analyst on the research behind it. What you'll do Strategy and research • Own the wider market view. Research the broader market GitLab competes in, beyond specific product categories: competitive dynamics, AI-native entrants, technology shifts and where value is moving. Collaborate with the team's Analyst on the research and turn the findings into a clear point of view on where GitLab should play. • Build an investment thesis for each focus area. Work with Product and Engineering leaders to define the problems worth solving, the capabilities GitLab needs, and what it would cost in time and money to get there on our own. • Own the competitive and landscape view. Maintain market maps and a current read on GitLab's competitors: their strategy, product direction, positioning, pricing, and M&A and funding activity. Produce competitor analyses that show where we lead, where we're exposed and how rivals are likely to move. Flag shifts by competitors, hyperscalers and AI labs that change our options, and bring the implications to Product and the executive team. • Define where GitLab should not play. Identify adjacencies that dilute focus and markets where the economics or competition work against us. Make the case for a no with the same rigor as a yes. Build, buy or partner • Run the build, buy, partner analysis. For each strategic gap, compare the options side by side on speed, cost, risk, control and strategic fit, and bring a clear recommendation. • Deliver strategic clarity to executives and the Board. Produce short strategy memos/decks and business cases that set out the decision, the trade-offs and what we give up with each path. • Feed company strategy and planning. Bring an outside-in view of the market and the inorganic options available into annual and long-range planning. • Work hand in hand with Strategic Partnerships. When partnering is the right answer, frame the opportunity and hand it to the partnership owner with a clear thesis. When it isn't, explain why. Deal execution and integration • Own end-to-end deal process management. Validate target fit against GitLab's our target profile, product roadmap and other criteria, and build the acquisition rationale and business case. Drive our M&A process from intro call through the various steps through to closing and integration. • Evaluate the deal. Develop valuation, commercial integrity assessment, impact on GitLab's business and provide negotiations assistance to the VP and the executive team. • Lead cross-functional diligence. Run pre-LOI validation and diligence across Product, Engineering, Security, Finance, Legal and People, and communicate findings clearly. • Drive deal documents with Legal. Prepare NDAs, LOIs and purchase agreements with GitLab Legal and outside counsel. • Own integration outcomes. Lead post-acquisition integration as the DRI, measured against the roadmap and business goals in the business case. Bring lessons learned back into the strategy work. • Build the external network. Maintain relationships with founders, executives, investors, bankers and advisors that bring us early insight and pipeline. What you'll bring • Strategy and deal experience. 8+ years across corporate development, corporate strategy, strategy consulting or technology investing, including 5+ years leading acquisitions end to end in enterprise software. • Structured strategic thinking. You form a point of view from incomplete information, test it against data, and change your mind when the evidence says so. You're as comfortable recommending that we stay out of a market as that we enter it. • Market research depth. Skilled in market sizing, competitive analysis and landscape mapping, and in turning research into a recommendation, not a report. • Deal craft. Skilled in valuation, financial modeling, deal structuring, negotiation and integration planning, with experience across varied consideration structures. • Technical fluency. A working understanding of software development, DevSecOps and the AI landscape, enough to hold substantive conversations with product and engineering leaders about roadmaps and architecture. • Clear executive communication. You write short, decision-ready updates and present trade-offs plainly to executives and the Board, in an async-first environment. • Influence without authority. You build trust across Product, Engineering, Finance and Legal and move decisions forward across functions. • Ownership with collaboration. You own the strategic view and the recommendation, and partner closely with the team's Analyst on research and analysis. • Preferred: familiarity with the DevSecOps, security, AI and open source ecosystems. • You value the all remote lifestyle and share our values. About the team The Corporate Development & Strategic Partnerships team helps GitLab decide how to grow beyond what we build on our own. We own inorganic strategy: acquisitions, strategic partnerships with hyperscalers and AI labs, and the research that tells us which to pursue and which to pass on. We work across Product, Engineering, Finance, Legal and the executive group. We set direction and do the detailed work ourselves, with a high degree of ownership and transparency in a fully remote, asynchronous environment. How GitLab Supports Full-Time Employees • Benefits to support your health, finances, and well-being • Flexible Paid Time Off • Team Member Resource Groups • Equity Compensation & Employee Stock Purchase Plan • Growth and Development Fund • Parental Leave Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement. Additionally, studies have shown that people from underrepresented groups are less likely to apply to a job unless they meet every single qualification. If you're excited about this role, please apply and allow our recruiters to assess your application. Country Hiring Guidelines: GitLab hires new team members in countries around the world. All of our roles are remote, however some roles may carry specific location-based eligibility requirements. Our Talent Acquisition team can help answer any questions about location after starting the recruiting process. Privacy Policy: Please review our Recruitment Privacy Policy. Your privacy is important to us. GitLab is proud to be an equal opportunity workplace and is an affirmative action employer. GitLab’s policies and practices relating to recruitment, employment, career development and advancement, promotion, and retirement are based solely on merit, regardless of race, color, religion, ancestry, sex (including pregnancy, lactation, sexual orientation, gender identity, or gender expression), national origin, age, citizenship, marital status, mental or physical disability, genetic information (including family medical history), discharge status from the military, protected veteran status (which includes disabled veterans, recently separated veterans, active duty wartime or campaign badge veterans, and Armed Forces service medal veterans), or any other basis protected by law. GitLab will not tolerate discrimination or harassment based on any of these characteristics. See also GitLab’s EEO Policy and EEO is the Law. If you have a disability or special need that requires accommodation, please let us know during the recruiting process.

GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50 million registered users and more than 50% of the Fortune 100* trust GitLab to ship better, more secure software faster. The same principles built into our products are reflected in how our team works: we embrace AI as a core productivity multiplier, with all team members expected to incorporate AI into their daily workflows to drive efficiency, innovation, and impact. GitLab is where careers accelerate, innovation flourishes, and every voice is valued. Our high-performance culture is driven by our values and continuous knowledge exchange, enabling our team members to reach their full potential while collaborating with industry leaders to solve complex problems. Co-create the future with us as we build technology that transforms how the world develops software. *Fortune 500® is a registered trademark of Fortune Media IP Limited, used under license. Claim based on GitLab data. Fortune 100 refers to the top 20% ranked companies in the 2025 Fortune 500 list, published in June 2025. Fortune and Fortune Media IP Limited are not affiliated with, and do not endorse products or services of GitLab. An overview of this role As an Intermediate Software Engineer on GitLab’s Vulnerability Management team, you’ll help build the core security workflows that GitLab Ultimate customers use to triage, prioritize, and act on vulnerabilities. You’ll work primarily in Ruby on Rails on backend systems, including security dashboards, vulnerability reports, and ingestion pipelines. You’ll take ownership of well-defined projects, solve technical problems with support from experienced team members, and collaborate with other engineers. You’ll also have opportunities to contribute beyond the backend when the work requires it. You will join a fullstack team, working together with product managers, designers, and frontend engineers to solve problems across the Vulnerability Management domain. What you’ll do • Develop and maintain backend features for GitLab’s vulnerability management workflows. • Confidently ship features and improvements with minimal guidance and support from other team members; collaborate with the team on larger projects. • Help improve the performance, reliability, and scalability of security data ingestion and reporting systems. • Collaborate with frontend engineers and contribute across the stack when needed. • Work with engineers across security teams as vulnerability data and workflows come together in Vulnerability Management. • Collaborate with Product Management and Product Design to maintain a high bar for quality • Craft code that meets our internal standards for style, maintainability, and best practices for a high-scale web environment • Conduct code reviews within our Code Review Guidelines and ensure community contributions receive a swift response • Recognize impediments to our efficiency as a team ("technical debt"), propose and implement solutions • Participate in on-call rotations to assist troubleshooting product operations, security operations, and urgent engineering issues. What you’ll bring • Experience building and maintaining backend applications with Ruby on Rails. • Experience delivering and maintaining software systems as part of a larger engineering team. • The ability to investigate technical problems, ask for context when needed, and work toward a practical resolution. • Experience working with relational databases such as PostgreSQL. • Clear communication and collaboration skills in a distributed team. • An interest in learning from others, sharing knowledge, and growing your technical skills. • Frontend development experience, including JavaScript or Vue.js, is helpful. • Experience with Elasticsearch, graph databases, vulnerability management, application security, or related transferable skills is helpful. About the team The Vulnerability Management team develops the core security workflows that help GitLab customers triage and manage vulnerabilities. The team owns areas including the security dashboard, vulnerability reports, and ingestion pipelines, and serves as an important interface for security-related features across GitLab. The team is focused on moving beyond lists of findings toward workflows that help customers prioritize and coordinate remediation. You’ll collaborate asynchronously with a small, distributed group and with related security teams, including the Agentic Security Flows team. How GitLab Supports Full-Time Employees • Benefits to support your health, finances, and well-being • Flexible Paid Time Off • Team Member Resource Groups • Equity Compensation & Employee Stock Purchase Plan • Growth and Development Fund • Parental Leave Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement. Additionally, studies have shown that people from underrepresented groups are less likely to apply to a job unless they meet every single qualification. If you're excited about this role, please apply and allow our recruiters to assess your application. Country Hiring Guidelines: GitLab hires new team members in countries around the world. All of our roles are remote, however some roles may carry specific location-based eligibility requirements. Our Talent Acquisition team can help answer any questions about location after starting the recruiting process. Privacy Policy: Please review our Recruitment Privacy Policy. Your privacy is important to us. GitLab is proud to be an equal opportunity workplace and is an affirmative action employer. GitLab’s policies and practices relating to recruitment, employment, career development and advancement, promotion, and retirement are based solely on merit, regardless of race, color, religion, ancestry, sex (including pregnancy, lactation, sexual orientation, gender identity, or gender expression), national origin, age, citizenship, marital status, mental or physical disability, genetic information (including family medical history), discharge status from the military, protected veteran status (which includes disabled veterans, recently separated veterans, active duty wartime or campaign badge veterans, and Armed Forces service medal veterans), or any other basis protected by law. GitLab will not tolerate discrimination or harassment based on any of these characteristics. See also GitLab’s EEO Policy and EEO is the Law. If you have a disability or special need that requires accommodation, please let us know during the recruiting process.

GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50 million registered users and more than 50% of the Fortune 100* trust GitLab to ship better, more secure software faster. The same principles built into our products are reflected in how our team works: we embrace AI as a core productivity multiplier, with all team members expected to incorporate AI into their daily workflows to drive efficiency, innovation, and impact. GitLab is where careers accelerate, innovation flourishes, and every voice is valued. Our high-performance culture is driven by our values and continuous knowledge exchange, enabling our team members to reach their full potential while collaborating with industry leaders to solve complex problems. Co-create the future with us as we build technology that transforms how the world develops software. *Fortune 500® is a registered trademark of Fortune Media IP Limited, used under license. Claim based on GitLab data. Fortune 100 refers to the top 20% ranked companies in the 2025 Fortune 500 list, published in June 2025. Fortune and Fortune Media IP Limited are not affiliated with, and do not endorse products or services of GitLab. An overview of this role We are hiring a Staff Product Security Architect to join our Security Platforms and Architecture organization at GitLab. Rather than operating as a purely consultative body, Security Architecture at GitLab functions as a hands-on technical driver. Our mission is to embed proactive guidance directly into modern developer workflows and automated coding environments, embedding security standards into the software development process from the outset. We strive to enable teams to deliver secure, resilient software seamlessly while minimizing reliance on manual security gates. In this role, you will collaborate closely with product engineering organizations, spearhead architectural strategy for critical capabilities, and serve as the primary Security Owner driving risk reduction for key entries within our risk management framework. Your daily work will span architectural design reviews, technical prototyping, and establishing scalable patterns that enable engineering teams to execute autonomously. What you’ll do • Partner with engineering and product leadership across GitLab, developing enough context in their domains to anticipate security problems rather than react to them • Lead security architecture and design work for strategic initiatives, and provide direction to the cross-functional teams delivering them • Identify, assess, and prioritise systemic security risks, and act as Security Owner for high-priority items in the Product Security Risk Register, co-executing remediation with the teams who own the code • Codify recurring security decisions into reusable artifacts — guardrails, standards, design patterns,skills, and reference threat models — delivered into developer and AI coding tool workflows • Build proofs of concept and prototypes to unblock engineering teams and shorten the distance between a security requirement and a working implementation • Conduct security architecture reviews for large or strategic projects, and coordinate with Application Security so that review coverage is comprehensive and correctly prioritised • Threat model new and existing systems, and establish the patterns that let teams threat model their own work • Work with Security Research on proactive exploration of unknown risks in GitLab's architecture • Anticipate emerging security challenges and propose architectural responses before they reach implementation • Mentor security engineers across the division, and represent security architecture to engineering audiences What you’ll bring • Depth in application security architecture, including authentication and authorization models, privilege escalation, multi-tenant isolation, and trust boundary analysis • Experience securing distributed systems, including service-to-service authentication, secrets handling, and the failure modes of security decisions made across process boundaries • Working knowledge of software supply chain security: build and release integrity, artifact provenance, and dependency risk • A track record of proactive architecture work — identifying risk before it becomes an incident, and designing something that prevents a class of problem rather than an instance of one • Demonstrated ability to build trusted relationships with engineering leadership and influence technical direction through expertise rather than gatekeeping • Experience defining security standards or patterns that teams adopted without being compelled to • The ability to operate strategically while remaining hands-on, including reading unfamiliar code, building prototypes, and contributing changes • Clear written communication, and the ability to make a security argument to an engineering audience that does not already agree with it • A view on how security guidance should be authored and delivered for AI coding tools, not only for humans About the team Security Architects are a part of our Security Platforms and Architecture team, who address complex security challenges facing GitLab and its customers to enable GitLab to be the most secure software factory platform on the market. Composed of Security Architecture, Security Research, and Application Security, we focus on systemic product security risks and work cross-functionally to mitigate them while maintaining Engineering’s development velocity. In FY27, we're implementing a new organizational model where each architect is dedicated to a specific functional area of GitLab's product, enabling deeper context, stronger relationships, and more proactive security guidance. As the Core DevOps architect, you'll be part of a team that includes architects focused on AI and the Sec Section, creating opportunities for collaboration on cross-cutting security challenges while maintaining specialized expertise in your domain. The base salary range for this role’s listed level is currently for residents of the United States only. This range is intended to reflect the role's base salary rate in locations throughout the US. Grade level and salary ranges are determined through interviews and a review of education, experience, knowledge, skills, abilities of the applicant, equity with other team members, alignment with market data, and geographic location. The base salary range does not include any bonuses, equity, or benefits. See more information on our benefits and equity. Sales roles are also eligible for incentive pay targeted at up to 100% of the offered base salary. United States Salary Range $168,000—$238,000 USD How GitLab Supports Full-Time Employees • Benefits to support your health, finances, and well-being • Flexible Paid Time Off • Team Member Resource Groups • Equity Compensation & Employee Stock Purchase Plan • Growth and Development Fund • Parental Leave Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement. Additionally, studies have shown that people from underrepresented groups are less likely to apply to a job unless they meet every single qualification. If you're excited about this role, please apply and allow our recruiters to assess your application. Country Hiring Guidelines: GitLab hires new team members in countries around the world. All of our roles are remote, however some roles may carry specific location-based eligibility requirements. Our Talent Acquisition team can help answer any questions about location after starting the recruiting process. Privacy Policy: Please review our Recruitment Privacy Policy. Your privacy is important to us. GitLab is proud to be an equal opportunity workplace and is an affirmative action employer. GitLab’s policies and practices relating to recruitment, employment, career development and advancement, promotion, and retirement are based solely on merit, regardless of race, color, religion, ancestry, sex (including pregnancy, lactation, sexual orientation, gender identity, or gender expression), national origin, age, citizenship, marital status, mental or physical disability, genetic information (including family medical history), discharge status from the military, protected veteran status (which includes disabled veterans, recently separated veterans, active duty wartime or campaign badge veterans, and Armed Forces service medal veterans), or any other basis protected by law. GitLab will not tolerate discrimination or harassment based on any of these characteristics. See also GitLab’s EEO Policy and EEO is the Law. If you have a disability or special need that requires accommodation, please let us know during the recruiting process.

GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50 million registered users and more than 50% of the Fortune 100* trust GitLab to ship better, more secure software faster. The same principles built into our products are reflected in how our team works: we embrace AI as a core productivity multiplier, with all team members expected to incorporate AI into their daily workflows to drive efficiency, innovation, and impact. GitLab is where careers accelerate, innovation flourishes, and every voice is valued. Our high-performance culture is driven by our values and continuous knowledge exchange, enabling our team members to reach their full potential while collaborating with industry leaders to solve complex problems. Co-create the future with us as we build technology that transforms how the world develops software. *Fortune 500® is a registered trademark of Fortune Media IP Limited, used under license. Claim based on GitLab data. Fortune 100 refers to the top 20% ranked companies in the 2025 Fortune 500 list, published in June 2025. Fortune and Fortune Media IP Limited are not affiliated with, and do not endorse products or services of GitLab. An overview of this role As a Staff Backend Engineer on GitLab's Security Factory: Code Scanning team, you help developers find and fix security issues. Those issues live in the code they write, and you set the technical direction for the static analysis engine that finds them. Your work spans two complementary parts of a complete security analysis. On the engine side, you shape how the static analysis toolkit models a program: parsing source into intermediate representations, resolving symbols, building call graphs, and tracking tainted data across files and languages. You define the architecture and specifications the team builds against, and you delegate component specifications within them to engineers and to the AI agents that implement them. On the evaluation side, you build and apply tooling that tests, measures, and validates what the engine finds against benchmark applications with known vulnerabilities. What the engine can model and how we measure what it finds are parts of one picture. As a Staff engineer you hold that picture, shape the long-range technical goals of the team, and raise the bar for every engineer on it. We build the engine with AI agents that write and review code from written specifications, under human direction. We expect you to direct that work effectively and with good judgment, and to help the team do the same. What you do • Act as the directly responsible individual (DRI) for the team's highest-scope initiatives from design through delivery, shipping large features with minimal guidance and shaping the long-range goals of the team • Bring systems built by one engineer to team ownership through documentation, tests, and shared review • Set the technical direction for the AI-assisted tooling that implements, reviews, and validates engine changes and findings, design the checks that decide whether an agent-written change or generated result is fit to merge, and measure detection quality against benchmark applications with known vulnerabilities, raising the bar for what counts as a trustworthy result. That includes static application security testing (SAST) rules mapped to CWE and OWASP, and the test fixtures that prove they work. • Own the architecture of the program model (parsing, symbol resolution, intermediate representations, call graphs, and taint and data-flow analysis) and of the pipeline that turns source code into findings, and define how both extend to new languages and frameworks • Solve technical problems of the highest scope and complexity, actively seek out difficult impediments affecting the whole team, and advocate for improvements to quality, security, and performance with Product Management, UX, and partner teams such as Code Security and Composition Analysis • Mentor all engineers on the team through code review and pairing, remove blockers to their autonomy, and shepherd the definition and improvement of our internal standards through review • Participate in on-call rotations to assist troubleshooting product operations, security operations, and urgent engineering issues • Define the overarching architecture and specification documents for the engine, delegate component specifications within them, and drive their implementation by AI agents and engineers working independently through phased plans, small reviewable units of change, and specifications kept in lockstep with the code • Build and maintain the harness, agent instructions, and agentic skills that keep agent-written code trustworthy, including separate coding and reviewing agents, rules and tests the coding agents cannot change, independent review panels of agents from different model providers, and performance, API, and dependency gates, with risky changes escalated to human review • Stay current with research in program analysis and security, run AI-assisted research and spikes, and turn the findings into prototypes, proposals, and upstream contributions, including responsible disclosure of findings in open source projects What you bring • Experience building your own LLM tooling, such as a harness, an agent pipeline, or evaluations, with the judgment to know when output is trustworthy and when it isn't • Extensive professional experience writing, testing, and reviewing production code in Rust, Go, or a comparable systems language, with depth in at least one. The engine is Rust, the analyzer wrapper is Go, and the monolith integration is Ruby, and we value willingness to work across them. • Experience with performance optimization and with containerized workflows and CI/CD (we use Docker heavily) • A deep program analysis and static analysis background, such as parsing and ASTs, intermediate representations (SSA, control-flow and call graphs), taint and data-flow analysis, type inference, incremental and fixpoint computation, or writing detection rules, with the ability to read, evaluate, and apply the research literature • Deep application security experience, such as vulnerability research, secure code review, or writing detection rules, and fluency with vulnerability classes (OWASP Top 10, CWE) • Demonstrated capacity to communicate clearly and concisely about complex technical, architectural, and organizational problems, and to write architecture and design specifications that bring a team to a decision • A track record of taking ownership of ambiguous, team-wide problems and shipping them from concept to production with minimal guidance, with specific, regular async updates on progress, blockers, risks, and next steps • Experience defining a system's overarching architecture, delegating component specifications to engineers and AI agents, and getting them implemented reliably • A track record of mentoring engineers, raising a team's technical bar, and influencing technical direction by achieving consensus with peers and leadership Helpful experience • Familiarity with popular web or mobile application frameworks and how they handle input, data, and configuration • Experience designing guardrails for agent-written code, such as mutation testing, fuzzing, and CI gates the coding agent cannot modify • A record of engaging with the research community, such as publications, tool papers, or upstream open source contributions in program analysis or security About the team The Security Factory: Code Scanning team develops GitLab's SAST capabilities for customer software repositories. We work closely with the Code Security team on scanning rules & flows, with Composition Analysis on the broader software supply chain, and with other groups across the Sec Section. We rely heavily on asynchronous work across time zones. Remote-Global The base salary range for this role’s listed level is currently for residents of the United States only. This range is intended to reflect the role's base salary rate in locations throughout the US. Grade level and salary ranges are determined through interviews and a review of education, experience, knowledge, skills, abilities of the applicant, equity with other team members, alignment with market data, and geographic location. The base salary range does not include any bonuses, equity, or benefits. See more information on our benefits and equity. Sales roles are also eligible for incentive pay targeted at up to 100% of the offered base salary. United States Salary Range $152,800—$259,200 USD How GitLab Supports Full-Time Employees • Benefits to support your health, finances, and well-being • Flexible Paid Time Off • Team Member Resource Groups • Equity Compensation & Employee Stock Purchase Plan • Growth and Development Fund • Parental Leave Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement. Additionally, studies have shown that people from underrepresented groups are less likely to apply to a job unless they meet every single qualification. If you're excited about this role, please apply and allow our recruiters to assess your application. Country Hiring Guidelines: GitLab hires new team members in countries around the world. All of our roles are remote, however some roles may carry specific location-based eligibility requirements. Our Talent Acquisition team can help answer any questions about location after starting the recruiting process. Privacy Policy: Please review our Recruitment Privacy Policy. Your privacy is important to us. GitLab is proud to be an equal opportunity workplace and is an affirmative action employer. GitLab’s policies and practices relating to recruitment, employment, career development and advancement, promotion, and retirement are based solely on merit, regardless of race, color, religion, ancestry, sex (including pregnancy, lactation, sexual orientation, gender identity, or gender expression), national origin, age, citizenship, marital status, mental or physical disability, genetic information (including family medical history), discharge status from the military, protected veteran status (which includes disabled veterans, recently separated veterans, active duty wartime or campaign badge veterans, and Armed Forces service medal veterans), or any other basis protected by law. GitLab will not tolerate discrimination or harassment based on any of these characteristics. See also GitLab’s EEO Policy and EEO is the Law. If you have a disability or special need that requires accommodation, please let us know during the recruiting process.