Opportunity at
GitLabIntermediate Backend Engineer, Authorization
GitLab operates an intelligent orchestration platform for DevSecOps, helping organizations boost developer productivity, enhance operational efficiency, mitigate security and compliance risks, and speed up digital transformation.…
Career Tools
About This Role
GitLab operates an intelligent orchestration platform for DevSecOps, helping organizations boost developer productivity, enhance operational efficiency, mitigate security and compliance risks, and speed up digital transformation. The company serves over 50 million registered users and more than half of the Fortune 100. As an Intermediate Backend Engineer on the Authorization team, you will help design, build, and maintain access control systems that govern what users, tokens, and automated agents can…
Job Description
GitLab operates an intelligent orchestration platform for DevSecOps, helping organizations boost developer productivity, enhance operational efficiency, mitigate security and compliance risks, and speed up digital transformation. The company serves over 50 million registered users and more than half of the Fortune 100.
As an Intermediate Backend Engineer on the Authorization team, you will help design, build, and maintain access control systems that govern what users, tokens, and automated agents can access across GitLab.com, Self-Managed, and Dedicated deployments. Working alongside experienced engineers, you will deliver well-scoped features and help migrate the existing Ruby on Rails policy layer to a new authorization stack that integrates the Rails monolith with a Rust policy engine.
This role involves handling fine-grained token permissions, custom roles, and both GraphQL and REST APIs. You will also participate in asynchronous workflows where decisions are documented in text or merge requests rather than live meetings, and you will be expected to incorporate AI tools into your daily tasks.
Responsibilities
- Write authorization changes in the Ruby on Rails monolith to control access rights.
- Deliver feature-flagged workstreams and verify that legacy and new systems yield identical outcomes.
- Develop and expand fine-grained permissions for user roles and tokens.
- Maintain and repair authorization enforcement across GraphQL and REST APIs.
- Perform incremental refactors on legacy policy code without disrupting current customer experiences.
- Resolve reliability, performance, and security problems tied to permission checks.
- Collaborate with platform, authentication, and AI departments to align interface contracts for the shared service.
- Contribute to architectural design documents, code reviews, and merge requests.
- Engage in operational support or on-call duties when required by the team.
Requirements
- Between 2 to 4 years or more of professional experience building and maintaining production Ruby on Rails applications.
- Practical background in authorization principles such as role-based access control or fine-grained permissions.
- Ability to execute careful code modifications, incremental refactors, and feature-flagged rollouts.
- Familiarity with API authorization patterns or GraphQL.
- Strong written communication skills for asynchronous environments.
Qualifications
- Practical background with PostgreSQL.
- Experience with Rust, Go, gRPC, Protocol Busters, Cedar, or alternative policy languages.
- Exposure to Zanzibar-style authorization architectures or service-oriented architecture.
- Transferable background from identity management, platform security, or policy engine domains.
Core Skills
Benefits
- Flexible paid time off
- Team member resource groups
- Equity compensation and employee stock purchase plan
- Growth and development fund
- Parental leave
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
What is the location or remote policy for this role?
The job posting indicates the location is India. It notes that GitLab hires team members globally, but specific location-based eligibility criteria may apply depending on the role.
What technologies will I work with?
You will primarily work with Ruby on Rails, GraphQL, REST APIs, and a new Rust policy engine utilizing gRPC. Helpful supplementary technologies include PostgreSQL, Go, Protocol Buffers, and Cedar.
What is the salary for this position?
The job posting does not specify a salary.
Do I need prior experience with Rust to apply?
No prior Rust experience is required, as the team provides support for engineers to learn it on the job.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.