SlipstreamJobs tracks this role from the company's public career site. Apply directly on the employer's site.
GitLab is seeking a Threat Research Engineer to research emerging security threats and develop protections for GitLab customers. This is a full-stack role where you will take research questions from conception through proof of concept, deployment, and analysis.
You will investigate new attack surfaces including AI coding agents, agent plugins, and package ecosystems. You'll build systems to detect threats and improve vulnerability advisories. AI is central to this work—you'll use AI tools daily and build agentic workflows for research, analysis, and detection.
Key responsibilities:
- Research new attack surfaces and threat vectors, including AI coding agents, agent plugins, and package ecosystems
- Find and responsibly disclose vulnerabilities in open source projects and developer tools
- Analyze software supply chain incidents and events
- Build AI-powered workflows and agents that automate research, analysis, and detection
- Build and maintain cloud-based systems for detection and advisory work
- Improve the quality and coverage of vulnerability and malware advisories
- Write findings as blog posts and present at conferences
You'll work within the Threat Research group, which maintains the GitLab Advisory Database powering GitLab's dependency scanning and publishes findings on the Security Labs blog. Recent work includes research on the Shai-Hulud npm worm and a critical RCE vulnerability in Serena, a popular MCP coding agent.
Requirements:
- Hands-on security experience in research, malware analysis, penetration testing, or security tooling, with understanding of package ecosystems and software supply chain attacks
- Both developer and adversarial mindset: ability to build systems and think about how to break them
- Demonstrated experience using AI in real work, such as building with LLM APIs or agent frameworks (LangChain, LangGraph, agent SDKs)
- Strong programming skills in Go or Python with good software engineering practices (testing, code review, CI/CD, maintainable code)
- Experience deploying and running production services on public cloud
- Ability to map attack vectors, explain trade-offs, and use data to move experiments forward
- Clear writing for engineers and general audiences; keeping up with security and AI industry trends
Helpful but not required: Google Cloud Platform (GCP), CVE entries or published findings, research on AI agents/LLM applications/MCP servers, blogs/talks/open source security tools, Terraform or OpenTofu, databases or data pipelines at scale, reverse engineering. Deep knowledge of compilers or SAST engines is not required.
