SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
GitLab is seeking an Intermediate Backend Engineer to join the Security Factory: Code Security team. This role focuses on building code-level security scanning capabilities, spanning static application security testing (SAST) and dependency scanning.
You will help developers find and fix security issues in the code they write and the open source components they depend on. Your work connects dependency analysis, vulnerability detection, and automated remediation. Key responsibilities include:
- Develop secure, well-tested, performant parsing for dependency manifests, lockfiles, and software bills of materials (SBOMs). Extend support for new package ecosystems and formats in the analysis engine and remediation service.
- Build and apply analyzers that combine deterministic analysis with AI-driven analysis. Review results and measure false positives and missed findings against benchmark applications with known vulnerabilities.
- Create detection rules mapped to Common Weakness Enumeration (CWE) and test fixtures that prove they work.
- Contribute to packaging analyzers for continuous integration (CI) jobs, AI agent workflows, and command-line tools, reporting findings in GitLab's standard security report formats.
- Extend the automated remediation service, from running dependency updates in a sandbox to opening merge requests.
- Solve technical problems of moderate scope and complexity. Identify technical debt and propose improvements.
- Write maintainable code meeting internal standards and help maintain those standards through code review.
- Participate in on-call rotations to troubleshoot product operations, security operations, and urgent engineering issues.
The team works closely with the Static Analysis team on SAST engines, Composition Analysis on the broader software supply chain, and other groups across the Security section. The role relies heavily on asynchronous work across time zones.
REQUIREMENTS:
- Experience using AI or large language model (LLM) tools to generate or evaluate technical content, with judgment to know when output is trustworthy.
- Solid professional experience writing and testing production code in a systems language, particularly Go and/or Rust. Experience with Ruby (for remediation) and Python (for some analyzers) valued, with willingness to work across multiple languages.
- Willingness to learn how vulnerabilities arise in code and the software supply chain, explore common vulnerability classes such as OWASP Top 10 and CWE, and apply static analysis to detect them. Deep expertise not required.
- Ability to organize work and follow through on tasks independently in a remote, largely asynchronous environment.
- Ability to communicate clearly and concisely about technical problems and propose iterative solutions.
- Helpful but not required: experience with containerized workflows and CI/CD; package managers and dependency tooling (npm, Maven, pip, Bundler, Cargo); web or mobile frameworks; parsing, abstract syntax trees (ASTs), program analysis, or detection rules; evaluating AI-driven detection against labeled data. Docker experience valued.
