SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
Salary: USD 152,800 - 259,200 / annual
GitLab is hiring a Staff Software Engineer for the Security Factory: Code Scanning team to lead the technical direction of a static analysis engine that helps developers find and fix security vulnerabilities in their code.
In this role, you will act as the directly responsible individual (DRI) for the team's highest-scope initiatives, owning the architecture and long-range technical goals of the static analysis engine. Your work spans two complementary areas: the engine side, where you shape how the static analysis toolkit models programs through parsing, symbol resolution, intermediate representations, call graphs, and taint/data-flow analysis; and the evaluation side, where you build tooling to test, measure, and validate findings against benchmark applications with known vulnerabilities.
You will define the overarching architecture and specifications for the engine, delegate component specifications to engineers and AI agents, and drive their implementation through phased plans and small reviewable units of change. A key part of this role involves designing and maintaining guardrails for agent-written code, including separate coding and reviewing agents, rules and tests that agents cannot modify, independent review panels from different model providers, and performance/API/dependency gates with risky changes escalated to human review.
You will mentor all engineers on the team through code review and pairing, solve technical problems of the highest scope and complexity, actively seek out impediments affecting the whole team, and advocate for improvements to quality, security, and performance with Product Management, UX, and partner teams. You will also participate in on-call rotations, stay current with program analysis and security research, and turn findings into prototypes, proposals, and upstream contributions.
The team works closely with Code Security, Composition Analysis, and other groups across the Security section, relying heavily on asynchronous work across time zones. GitLab embraces AI as a core productivity multiplier, and you are expected to incorporate AI into your daily workflows.
**Requirements:**
- Experience building your own LLM tooling (harness, agent pipeline, or evaluations) with judgment to assess trustworthiness of output
- Extensive professional experience writing, testing, and reviewing production code in Rust, Go, or comparable systems language, with depth in at least one
- Experience with performance optimization and containerized workflows/CI/CD (Docker)
- Deep program analysis and static analysis background: parsing, ASTs, intermediate representations (SSA, control-flow, call graphs), taint and data-flow analysis, type inference, incremental and fixpoint computation, or writing detection rules; ability to read and apply research literature
- Deep application security experience: vulnerability research, secure code review, or writing detection rules; fluency with OWASP Top 10 and CWE
- Demonstrated capacity to communicate clearly about complex technical, architectural, and organizational problems; ability to write architecture and design specifications that bring teams to decisions
- Track record of taking ownership of ambiguous, team-wide problems and shipping them from concept to production with minimal guidance, with regular async updates on progress, blockers, risks, and next steps
- Experience defining a system's overarching architecture, delegating component specifications to engineers and AI agents, and getting them implemented reliably
- Track record of mentoring engineers, raising a team's technical bar, and influencing technical direction through consensus with peers and leadership
**Helpful Experience:**
- Familiarity with popular web or mobile application frameworks and how they handle input, data, and configuration
- Experience designing guardrails for agent-written code (mutation testing, fuzzing, CI gates)
- Record of engaging with research community (publications, tool papers, upstream open source contributions in program analysis or security)
