Opportunity at
GitLabStaff Software Engineer, Security Factory: Static Analysis
GitLab is hiring a Staff Software Engineer for its Code Scanning group, which supports developers in finding and fixing security flaws in their own code. The…
Career Tools
About This Role
GitLab is hiring a Staff Software Engineer for its Code Scanning group, which supports developers in finding and fixing security flaws in their own code. The listing shows the role as remote and global, with a separate US base salary band. The static analysis engine that surfaces those flaws is where this engineer defines the technical course. The work has two connected halves. On the engine side, the engineer shapes…
Job Description
GitLab is hiring a Staff Software Engineer for its Code Scanning group, which supports developers in finding and fixing security flaws in their own code. The listing shows the role as remote and global, with a separate US base salary band. The static analysis engine that surfaces those flaws is where this engineer defines the technical course.
The work has two connected halves. On the engine side, the engineer shapes how the toolkit models software: converting source into intermediate forms, resolving names, building call graphs and following data flows that carry untrusted input across files and languages. On the evaluation side, the engineer creates tooling that scores detection results against benchmark programs with documented weaknesses. Because the team builds the engine with AI agents working from written specs under human supervision, the engineer also defines how that AI-assisted development operates and designs checks that decide whether machine-written changes are safe to merge.
As the directly responsible individual for major initiatives, the engineer drives large features with light oversight, sets long-term team goals, converts personally built systems into shared team assets, mentors others through review and pairing, and takes part in on-call coverage. The stack includes Rust for the engine, Go for the analyzer wrapper and Ruby for the monolith link. The engineer collaborates with Code Security and Composition Analysis, mostly asynchronously across time zones.
Responsibilities
- Act as the accountable lead for the team's largest initiatives, from design through shipment
- Chart the course for AI-assisted tools that build, review and vet engine changes
- Take responsibility for how the program model is structured: parsing, symbol resolution, intermediate forms, call graphs and taint analysis
- Write architecture and specification documents, delegate component specs and oversee their build-out
- Develop and keep up the test rig, agent guidance and review checkpoints for machine-written code
- Score how well detection performs on benchmark apps seeded with known vulnerabilities
- Mentor engineers through review and pairing, and uphold team standards
- Join on-call rotations for product, security and urgent engineering incidents
Requirements
- Track record building LLM-based systems: harnesses, agent pipelines or evaluation suites, with a sense of when output can be trusted
- Substantial production work in one of Rust, Go or similar systems languages, with real depth in at least one
- Comfort working across Rust, Go and Ruby
- Background in performance tuning, containers and CI/CD, with heavy Docker usage
- Deep static analysis knowledge: parsers, syntax trees, intermediate representations, taint and data-flow analysis, or detection-rule authoring
- Deep appsec background spanning vuln research, secure code review or detection rules, with fluency in OWASP Top 10 and CWE
- Concise, clear communication of complex technical and organizational issues; writes architecture documents that lead to decisions
- Record of delivering ambiguous, team-wide work into production with light supervision and regular async updates
- Has set overall architecture and passed component specs to people and AI agents for build-out
- Record of mentoring engineers and raising the technical bar for a team
Qualifications
- Hands-on work with widely used web or mobile frameworks
- Guardrails for agent-written code: mutation testing, fuzzing, and pipeline checks the agent is unable to change
- Research engagement: papers, tool publications, or contributions to open projects upstream
Core Skills
Benefits
- Flexible time-off policy
- Employee resource groups
- Equity awards and an employee share purchase plan
- Fund supporting professional growth
- Leave for new parents
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is the role remote?
The listing describes it as remote and global. Some roles carry location-based eligibility rules.
What is the US base salary range?
$152,800 to $259,200 USD for US residents at this level, excluding bonus, equity and benefits.
Which languages does the team use?
Rust for the engine, Go for the analyzer wrapper, and Ruby for the monolith integration.
Is LLM tooling experience required?
Yes. Hands-on experience building LLM-based systems, such as a harness or agent pipeline, is a stated requirement.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.