Staff Software Engineer, Security Platform: Authentication

Career Tools

About This Role

GitLab operates an intelligent orchestration platform for DevSecOps, helping organizations boost developer productivity, enhance operational efficiency, decrease security and compliance risks, and expedite digital transformation. The company seeks a Staff Software Engineer to join the Authentication team within the Security Platform stage. In this technical lead capacity, you will oversee how human users, external applications, security tokens, and automated agents establish their identity across GitLab.com, Self-Managed, and Dedicated deployments. Operating…

Job Description

Responsibilities

• Own the overarching technical direction for authentication protocols like OAuth 2.0, OIDC, SAML, and token exchange across the Ruby on Rails monolith and Go-based GATE services
• Write and implement design documents and architecture decision records for multi-quarter initiatives, dividing work into increments deployed behind feature flags
• Direct migrations involving token formats, client and grant state, and session behavior without causing disruptions for current customers
• Write code in Ruby on Rails and Go while reviewing designs and merge requests submitted by peers
• Establish interface contracts with GATE Core, GATE Infra, Authorization, and Tenant Scale teams and update them as the architecture evolves
• Perform threat modeling on new identity flows, introduce rate limits and abuse prevention controls, and guide technical responses to security incidents
• Mentor senior and intermediate engineers to improve overall protocol and security competencies within the group
• Collaborate asynchronously with engineering teammates globally, primarily documenting decisions in writing
• Participate in on-call or operational support rotations as mandated by the team structure

Requirements

• Substantial background in designing, building, and operating production-grade authentication or identity systems at scale
• Deep practical knowledge of OAuth 2.0 and OIDC protocols including authorization code with PKCE, refresh token rotation, token exchange, client registration, scopes, and JSON Web Tokens
• Working knowledge of SAML 2.0 single sign-on and enterprise identity integrations such as LDAP and SCIM
• Extensive production experience utilizing either Ruby on Rails or Go, with a willingness to write both
• Demonstrated ability to execute refactoring, feature-flagged rollouts, and backward-compatible migrations within large codebases
• Familiarity with multi-tenant SaaS environments, covering data isolation and high-volume request performance
• Proficiency in written English suited for an asynchronous and distributed work environment

Qualifications

• Experience with authentication libraries including Doorkeeper, Devise, or OmniAuth
• Familiarity with passkeys, multi-factor authentication, workload identity, gateways, policy engines, or AI agent authentication
• Background in multi-region architectural designs
• Prior contributions toward identity standards or open-source identity projects

Core Skills

Benefits

• Flexible Paid Time Off
• Team Member Resource Groups
• Equity Compensation and Employee Stock Purchase Plan
• Growth and Development Fund
• Parental Leave

Frequently Asked Questions

Answers are based only on the employer’s listing; where it doesn’t say, neither do we.

Sample Interview Questions

AI-generated questions tailored to this specific role — a preview of the full practice set.