Specialty
The role
GitLab is hiring a senior backend engineer for its Security Factory: Code Security team. The work covers dependency analysis and hybrid rule-based and AI vulnerability detection, plus an automated service that opens merge requests to fix vulnerable dependencies. The role is remote.
What you will do
- Own team initiatives from design through delivery as the directly responsible individual, with little guidance
- Build analyzers that combine deterministic analysis with AI, plus evaluation harnesses that measure false positives and misses
- Write detection rules mapped to CWE and the test fixtures that prove they work
- Build parsing of manifests, lockfiles and SBOMs, and extend it to new ecosystems
- Add features to the service that turns security advisories into dependency-update merge requests
- Mentor intermediate engineers through code review and join on-call rotations
What they ask for
- Experience building your own LLM tooling such as a harness, agent pipeline or evaluations
- Substantial production experience in Go and/or Rust, with depth in at least one
- Familiarity with package managers such as npm, Maven, pip, Bundler or Cargo
- Application security experience: vulnerability research, secure code review or writing detection rules
- Knowledge of OWASP Top 10, CWE and the software supply chain
- Ability to work independently in a remote, largely asynchronous environment
- Clear written communication, including design proposals
This is our own short reading of the posting. The full description, and anything that has changed since, is on GitLab's careers page behind the apply button.
