Remote opportunity at
GitLabStaff Security Researcher
GitLab operates an intelligent orchestration platform for DevSecOps, serving over fifty million registered users and more than fifty percent of the Fortune 100. The company is…
Career Tools
About This Role
GitLab operates an intelligent orchestration platform for DevSecOps, serving over fifty million registered users and more than fifty percent of the Fortune 100. The company is currently hiring a remote, full-time Staff Security Researcher to join the Application Security Team. In this position, the professional will spearhead cutting-edge security research targeting GitLab's AI-powered DevSecOps features, such as the Duo Agent Platform and GitLab Duo Chat. This role suits an offensive…
Job Description
GitLab operates an intelligent orchestration platform for DevSecOps, serving over fifty million registered users and more than fifty percent of the Fortune 100. The company is currently hiring a remote, full-time Staff Security Researcher to join the Application Security Team. In this position, the professional will spearhead cutting-edge security research targeting GitLab's AI-powered DevSecOps features, such as the Duo Agent Platform and GitLab Duo Chat.
This role suits an offensive security expert who wants to investigate AI agent security, build automated testing tooling, and analyze complex systemic attack vectors. Reporting to the Senior Manager of Application Security, the researcher will create novel testing methodologies, construct proof-of-concept exploits, and collaborate with engineering groups to fix systemic vulnerabilities. Candidates should possess deep knowledge in vulnerability discovery, fluency in multiple programming languages, and a strong understanding of artificial intelligence attack methodologies.
Responsibilities
- Perform security research across a minimum of two specialty domains.
- Uncover and analyze systemic, novel, and chained vulnerabilities within GitLab.
- Test vulnerabilities via hands-on methods and build proof-of-concept exploits.
- Address emerging industry vulnerability classes and drive architectural remediation.
- Investigate AI and agentic attack surfaces to formulate engineering security requirements.
- Develop automation tools and scripts to scale agent-assisted vulnerability discovery.
- Examine the security posture of third-party open-source dependencies integrated with GitLab.
- Solve highly ambiguous technical problems and shape the team roadmap.
- Deliver actionable remediation guidance and mentorship to engineering teams.
- Contribute findings and novel vulnerability types back to the broader security community.
Requirements
- Seven or more years of professional background in penetration testing, offensive security, or security research.
- Demonstrated hands-on expertise in identifying and exploiting software vulnerabilities.
- Subject matter expertise in at least two technical areas impacting product security.
- Practical coding proficiency in one or more languages including Ruby, Go, Python, TypeScript, or Rust.
- Comprehension of AI attack vectors encompassing workflow exploitation, prompt injection, and agent manipulation.
- Demonstrated experience steering technical objectives across cross-functional teams.
- Superior written communication skills for translating technical findings into risk assessments.
- Strong analytical capabilities combined with creative problem-solving regarding attack patterns.
Qualifications
- Prior published security research or conference speaking engagements.
- Background in software engineering paired with distributed systems expertise.
- Security credentials such as OSCP, OSCE, GPEN, or equivalent designations.
- Familiarity with GitLab or comparable DevSecOps platform environments.
- Practical exposure to artificial intelligence frameworks.
Core Skills
Benefits
- Flexible Paid Time Off
- Team Member Resource Groups
- Equity Compensation and Employee Stock Purchase Plan
- Growth and Development Fund
- Parental Leave
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is this position remote?
Yes, this is a remote full-time role, though some positions may carry specific location-based eligibility rules defined by the hiring team.
What is the salary range for this role?
The base salary range for United States residents is $168,000 to $238,000 USD, though final compensation depends on factors like experience, location, and market data.
Who does this role report to?
The Staff Security Researcher reports directly to the Senior Manager of Application Security.
What level of experience is required?
Applicants must have seven or more years of experience in security research, offensive security, or penetration testing.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.