Opportunity at
GitLabStaff Software Engineer, Security Factory: Static Analysis
GitLab is seeking a Staff Software Engineer for its Security Factory: Static Analysis team to guide the technical direction of the static analysis engine that helps…
Career Tools
About This Role
GitLab is seeking a Staff Software Engineer for its Security Factory: Static Analysis team to guide the technical direction of the static analysis engine that helps developers identify and remediate security vulnerabilities. In this position, you will design program models including parsing source code, symbol resolution, building call graphs, and tracing taint across multiple files and programming languages. You will also build evaluation tooling to test and validate engine detections…
Job Description
GitLab is seeking a Staff Software Engineer for its Security Factory: Static Analysis team to guide the technical direction of the static analysis engine that helps developers identify and remediate security vulnerabilities. In this position, you will design program models including parsing source code, symbol resolution, building call graphs, and tracing taint across multiple files and programming languages. You will also build evaluation tooling to test and validate engine detections against vulnerability benchmarks. GitLab builds software utilizing AI agents that write and review code based on formal specifications under human supervision, and this position requires directing that workflow effectively. The engine is developed primarily in Rust, with analyzer wrappers in Go and integration layers in Ruby, supporting work across these technologies. The company operates as an intelligent orchestration platform for DevSecOps, aiding organizations in accelerating digital transformation and enhancing developer productivity.
This role suits an experienced engineer with a deep background in program and static analysis, application security, and LLM tooling development. Ideal candidates possess strong systems programming experience in Rust, Go, or similar languages, along with a track record of independently solving complex technical challenges, mentoring team members, and delivering large-scale engineering initiatives from concept to production.
Responsibilities
- Act as the directly responsible individual for major team initiatives from design through deployment
- Define architecture and specifications for the static analysis engine and program model
- Direct AI-assisted tooling to implement, review, and validate engine updates and findings
- Measure detection quality against benchmark applications containing known vulnerabilities
- Transition systems built by individual engineers into team-owned assets via tests and documentation
- Mentor team members through code reviews, pairing, and internal standard definitions
- Participate in on-call rotations to handle operational, security, and engineering issues
- Conduct AI-assisted research and spikes to prototype improvements and upstream contributions
Requirements
- Experience building LLM tooling such as harnesses, agent pipelines, or evaluations
- Professional background writing, testing, and reviewing production code in Rust, Go, or another systems language
- Experience with performance optimization, containerized workflows, and CI/CD using Docker
- Background in program analysis and static analysis concepts like ASTs, intermediate representations, and taint analysis
- Application security expertise encompassing vulnerability research, secure code review, and vulnerability classes
- Capacity to communicate architectural concepts clearly and author design specifications
Qualifications
- Familiarity with web or mobile application frameworks and input handling
- Experience designing guardrails for agent-written code such as fuzzing, mutation testing, and CI gates
- Background engaging with the research community through publications, tool papers, or open source contributions
Core Skills
Benefits
- Flexible paid time off
- Team member resource groups
- Equity compensation and employee stock purchase plan
- Growth and development fund
- Parental leave
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
What is the salary range for this position?
The base salary range for United States residents is USD 152,800 to 259,200 per year, determined through interviews, experience, qualifications, and geographic location.
What programming languages are used in this role?
The analysis engine is written in Rust, the analyzer wrapper uses Go, and the monolith integration is built in Ruby.
Is this position remote?
The source posting states that GitLab hires team members globally and that all roles are remote, though some positions may carry specific location-based eligibility requirements.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.
