Senior Software Engineer, Security Factory: Code Security

An Overview of this Role

As a Senior Backend Engineer on GitLab's Security Factory: Code Security team, you help developers find and fix security issues. Those issues live in the code they write and in the open source components they depend on.

Your work spans complementary parts of a complete security analysis. On the dependency analysis side, you teach the analysis engine what a project depends on by parsing dependency manifests, lockfiles, and SBOMs, and you extend the service that turns security advisories into automated merge requests. On the vulnerability detection side, you grow GitLab's security analysis engine with hybrid analyzers that blend rule-based detection and AI reasoning.

What You Do

• Act as the directly responsible individual (DRI) for team initiatives from design through delivery, shipping with minimal guidance in partnership with the technical lead.
• Bring systems built by one engineer to team ownership through documentation, tests, and shared review.
• Design and ship analyzers that pair deterministic analysis capabilities with AI-driven analysis, and build evaluation harnesses that measure false positives and missed findings.
• Package analyzers for CI jobs, AI agent workflows, and command-line tools with findings reported in GitLab's standard formats.
• Design and ship manifest, lockfile, and SBOM parsing to extend coverage to new ecosystems and formats.
• Ship features across the automated remediation service that turns security advisories into dependency update merge requests.
• Solve technical problems of high scope and complexity, advocating for improvements to quality, security, and performance.
• Mentor Intermediate engineers through code review and pairing.
• Participate in on-call rotations to assist troubleshooting product operations, security operations, and urgent engineering issues.

What You Bring

• Experience building your own LLM tooling, such as a harness, an agent pipeline, or evaluations.
• Substantial professional experience writing and testing production code in a systems language, particularly Go and/or Rust, with depth in at least one. Willingness to work across Ruby and Python.
• Familiarity with package managers and dependency management in one or more language ecosystems (npm, Maven, pip, Bundler, Cargo, etc.).
• Demonstrated application security experience, such as vulnerability research, secure code review, or writing detection rules, and fluency with vulnerability classes (OWASP Top 10, CWE) and software supply chains.
• Track record of taking ownership of ambiguous problems and shipping with minimal guidance in an asynchronous, remote environment.
• Capacity to communicate clearly and concisely about technical problems and write design proposals.

Helpful Experience

• Evaluating AI-driven detection against labeled data, including measuring false positives and missed findings.
• Performance optimization at scale.
• Hands-on program analysis experience, such as parsing, ASTs, or data-flow analysis.
• Familiarity with popular web or mobile application frameworks and how they handle input, data, and configuration.
• Experience with containerized workflows and CI/CD (heavy use of Docker).