SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 139,200 - 235,200 / annual
GitLab is seeking a Senior Backend Engineer for the Security Factory: Code Security team, which builds code-level security scanning capabilities spanning static application security testing (SAST) and dependency scanning. This role focuses on helping developers find and fix security issues in both the code they write and the open source components they depend on.
You will work across two complementary areas: dependency analysis and vulnerability detection. On the dependency side, you will parse dependency manifests, lockfiles, and SBOMs to teach the analysis engine what a project depends on, and extend the service that turns security advisories into automated merge requests for vulnerable dependency updates. On the vulnerability detection side, you will grow GitLab's security analysis engine with hybrid analyzers that blend rule-based detection and AI reasoning, build tooling to develop and evaluate those analyzers, and measure their effectiveness against real problems.
Key responsibilities include acting as the directly responsible individual (DRI) for team initiatives from design through delivery with minimal guidance; designing and shipping analyzers that pair deterministic analysis with AI-driven analysis, including evaluation harnesses that measure false positives and missed findings; packaging analyzers for CI jobs, AI agent workflows, and command-line tools; designing and shipping manifest/lockfile/SBOM parsing for new ecosystems and formats; shipping features for the automated remediation service; solving high-scope technical problems and advocating for improvements to quality, security, and performance; mentoring intermediate engineers through code review and pairing; and participating in on-call rotations.
The team works closely with the Static Analysis team, Composition Analysis, and other groups across the Security section, relying heavily on asynchronous work across time zones. You will make thoughtful use of AI-assisted development tools in daily work and are expected to use them effectively and with good judgment.
REQUIREMENTS:
- Experience building LLM tooling such as harnesses, agent pipelines, or evaluations, with judgment to assess trustworthiness of output
- Substantial professional experience writing and testing production code in systems languages, particularly Go and/or Rust, with depth in at least one (also uses Ruby and Python)
- Familiarity with package managers and dependency management in one or more language ecosystems (npm, Maven, pip, Bundler, Cargo); experience building tooling around them is preferred
- Demonstrated application security experience such as vulnerability research, secure code review, or writing detection rules; fluency with vulnerability classes (OWASP Top 10, CWE) and software supply chain
- Track record of taking ownership of ambiguous problems and shipping with minimal guidance; self-motivation and organizational skills suited to remote, asynchronous environment
- Demonstrated capacity to communicate clearly and concisely about technical problems and write design proposals that bring a team to decision
HELPFUL EXPERIENCE:
- Experience evaluating AI-driven detection against labeled data, including measuring false positives and missed findings
- Experience with performance optimization at scale
- Hands-on program analysis experience such as parsing, ASTs, or data-flow analysis
- Familiarity with popular web or mobile application frameworks and how they handle input, data, and configuration
- Experience with containerized workflows and CI/CD (Docker)
