Remote opportunity at
GitLabPrincipal Security Researcher
GitLab is seeking a remote Principal Security Researcher to join its Application Security Team. In this role, the successful candidate will execute advanced security research focused…
Career Tools
About This Role
GitLab is seeking a remote Principal Security Researcher to join its Application Security Team. In this role, the successful candidate will execute advanced security research focused on AI-powered DevSecOps features, including the Duo Agent Platform, GitLab Duo Chat, and other AI workflows. The position involves discovering systemic vulnerabilities, creating testing methodologies, performing penetration testing, and shaping product security standards. This opportunity suits an experienced offensive security expert who wants to…
Job Description
GitLab is seeking a remote Principal Security Researcher to join its Application Security Team. In this role, the successful candidate will execute advanced security research focused on AI-powered DevSecOps features, including the Duo Agent Platform, GitLab Duo Chat, and other AI workflows. The position involves discovering systemic vulnerabilities, creating testing methodologies, performing penetration testing, and shaping product security standards. This opportunity suits an experienced offensive security expert who wants to safeguard software platforms utilized by millions of developers globally.
GitLab operates as an intelligent orchestration platform designed for DevSecOps, helping organizations boost developer efficiency, streamline operations, and minimize security and compliance risks. More than half of the Fortune 100 and tens of millions of registered users rely on the platform to deliver secure software rapidly. The company embraces a high-performance culture that values knowledge sharing and incorporates artificial intelligence as a primary productivity driver in daily workflows.
Responsibilities
- Conduct and lead security research across multiple functional areas
- Identify novel, systemic, and chained vulnerabilities within GitLab systems
- Validate security flaws through hands-on testing and develop proof-of-concept exploits
- Analyze emerging industry vulnerability classes and drive systemic remediation across the codebase
- Investigate security and agentic surfaces related to AI and define corresponding security requirements for engineering teams
- Build and direct tooling and automation for scalable security research, such as agent-assisted vulnerability discovery
- Examine the security posture of integrated open-source tools and dependencies, reporting findings to maintainers and tracking mitigation
- Solve highly complex and ambiguous technical problems and help guide sub-department and team roadmaps
- Integrate research results into relevant business and engineering functions
- Mentor domain experts and individual contributors while sharing novel vulnerability types with the broader security community
Requirements
- 10 or more years of experience in penetration testing, offensive security, or security research roles
- Strong capability in locating and exploiting vulnerabilities within complex systems and large codebases
- Proficiency in a minimum of two languages from Ruby, Go, Python, TypeScript, or Rust
- Ability to read and analyze code across diverse codebases and programming languages
- Solid knowledge of AI frameworks and AI attack vectors including prompt injection, workflow exploitation, and agent manipulation
- Skill in establishing and managing complex remediation initiatives across cross-functional teams
- Excellent written communication skills with the ability to explain complex technical concepts concisely
- Aptitude for translating technical findings into clear risk assessments and actionable remediation steps
- Strong analytical and problem-solving skills with creative thinking regarding attack scenarios
Qualifications
- Published security research or conference presentations
- Background in software engineering with distributed systems expertise
- Prior experience working with GitLab or comparable DevSecOps platforms
Core Skills
Benefits
- Flexible Paid Time Off
- Team Member Resource Groups
- Equity Compensation and Employee Stock Purchase Plan
- Growth and Development Fund
- Parental Leave
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is this position remote?
Yes, this role is fully remote, though certain location-based eligibility requirements may apply depending on the country.
What is the employment type?
This is a full-time position.
What is the salary for this role?
The base salary range for United States residents is $203,200 to $275,000 USD, though exact compensation depends on factors such as experience, location, and market data. Salaries for locations outside the US are not specified in the posting.
Who does this role report to?
The Principal Security Researcher reports to the Senior Manager of Application Security.
What level of experience is required?
Candidates must have 10 or more years of experience in security research, penetration testing, or offensive security roles.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.