Opportunity at
GitLabSenior Software Engineer, Security Factory: Code Security
GitLab's Code Security group builds code-level scanning, covering SAST along with checks on third-party packages, so developers can catch problems early in their own code and…
Career Tools
About This Role
GitLab's Code Security group builds code-level scanning, covering SAST along with checks on third-party packages, so developers can catch problems early in their own code and in open-source dependencies. The senior backend engineer works on two fronts: keeping the analysis engine informed about project dependencies, and extending vulnerability detection with analyzers that mix deterministic rules with AI reasoning. The listing describes the role as remote. On the dependency side, the…
Job Description
GitLab's Code Security group builds code-level scanning, covering SAST along with checks on third-party packages, so developers can catch problems early in their own code and in open-source dependencies. The senior backend engineer works on two fronts: keeping the analysis engine informed about project dependencies, and extending vulnerability detection with analyzers that mix deterministic rules with AI reasoning. The listing describes the role as remote.
On the dependency side, the engineer reads package manifests, lock files and SBOM documents to help the engine understand which libraries a project uses and how its code calls them, and improves the service that converts advisories into automated merge requests for vulnerable packages. On the detection side, the engineer builds and ships analyzers that combine deterministic checks with AI-driven reasoning, and creates evaluation harnesses that count false alarms and missed issues against benchmark applications with known flaws. The analyzers run inside CI jobs, agent pipelines and command-line utilities, and output findings in GitLab's standard report formats.
The engineer leads projects from design through delivery as the directly responsible individual, coaches intermediate engineers through reviews and pairing, and takes part in on-call duty. The group partners with Static Analysis on SAST engines and with Composition Analysis on supply chain topics, typically working asynchronously across time zones.
Responsibilities
- Lead projects from concept to release, serving as the directly responsible individual
- Build and release analyzers combining rule-based analysis with AI-driven analysis
- Build evaluation harnesses that tally false alarms and omissions versus benchmark applications
- Package analyzers for CI pipelines, agent pipelines and command-line utilities
- Build manifest, lockfile and SBOM parsing, then widen it to other package ecosystems
- Ship features in the automated remediation service that opens dependency update merge requests
- Coach intermediate engineers through reviews and pairing
- Take part in on-call rotations for product, security and urgent engineering issues
Requirements
- Track record with LLM-powered tooling (harnesses, agent pipelines, evaluation suites), knowing when output is trustworthy
- Production track record in systems-level coding, mainly Go or Rust, deep in at least one, and open to Ruby and Python
- Comfortable with dependency tooling in ecosystems like Cargo, Bundler, pip, Maven and npm
- Application security background spanning vuln research, secure code review or detection rules
- Fluency with OWASP Top 10, CWE and software supply chain risk
- Track record of owning ambiguous problems and shipping them with little guidance in a remote, async setting
- Clear, concise technical writing, and design proposals that move a team to a decision
Qualifications
- Measuring false alarms and misses of AI-based detectors on tagged datasets (helpful)
- Performance work at scale (helpful)
- Program analysis know-how: syntax tree work, parsers or data flow tracking (helpful)
- Comfort with common web or mobile frameworks (helpful)
- Containerized workflows and CI/CD, with heavy Docker use (helpful)
Core Skills
Benefits
- Flexible time-off policy
- Employee resource groups
- Equity awards and an employee share purchase plan
- Fund supporting professional growth
- Leave for new parents
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is the role remote?
The listing describes it as remote and global. Some roles carry location-based eligibility requirements.
What is the US base salary range?
$139,200 to $235,200 USD for US residents at this level, excluding bonuses, equity and benefits.
Which languages are used?
Go and Rust mainly, Ruby for remediation work, and Python for some analyzers.
Is on-call work part of the role?
Yes, the engineer joins on-call rotations.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.