Senior Software Engineer, Code Security at GitLab

About the role

Senior backend engineer building AI-assisted analyzers, dependency scanning, and remediation tools for GitLab’s DevSecOps platform. Improving code security across ecosystems, CI workflows, and AI agent tooling.

Act as the directly responsible individual for team initiatives from design through delivery
Bring systems built by one engineer to team ownership through documentation, tests, and shared review
Design and ship analyzers combining deterministic analysis with AI-driven analysis
Build evaluation harnesses measuring false positives and missed findings against benchmark applications
Develop detection rules mapped to CWE and test fixtures
Package analyzers for CI jobs, AI agent workflows, and command-line tools using GitLab security report formats
Design and ship manifest, lockfile, and SBOM parsing across ecosystems and formats
Extend automated remediation that turns security advisories into dependency update merge requests
Solve high-scope technical problems and improve quality, security, and performance with cross-functional and partner teams
Mentor Intermediate engineers through code review and pairing
Participate in on-call rotations for product, security, and urgent engineering issues

Experience building your own LLM tooling, such as a harness, an agent pipeline, or evaluations, with the judgment to know when output is trustworthy
Substantial professional experience writing and testing production code in a systems language, particularly Go and/or Rust, with depth in at least one
Willingness to work across Go, Rust, Ruby, and Python
Familiarity with package managers and dependency management in one or more ecosystems, such as npm, Maven, pip, Bundler, or Cargo
Demonstrated application security experience, such as vulnerability research, secure code review, or writing detection rules
Fluency with OWASP Top 10, CWE, and the software supply chain
Track record of taking ownership of ambiguous problems and shipping with minimal guidance
Self-motivation and organizational skills suited to a remote, largely asynchronous environment
Capacity to communicate clearly and concisely about technical problems
Ability to write design proposals that bring a team to a decision
Helpful: experience evaluating AI-driven detection against labeled data, performance optimization at scale, program analysis, web/mobile application frameworks, containerized workflows, and CI/CD