Intermediate Backend Engineer, Authorization

Overview

Help build and maintain GitLab's Authorization system, which decides what every user, token, and automated agent can access on GitLab.com, Self-Managed, and Dedicated. Work is in Ruby on Rails today, with contribution to the move toward a new authorization stack that pairs the Rails monolith with a Rust policy engine.

What you'll do

• Implement authorization changes in GitLab's Ruby on Rails monolith so permission checks allow intended access and deny unauthorized access.
• Deliver well-scoped workstreams from feature-flagged rollout through verifying that the old and new systems produce the same results, with review and guidance from senior engineers.
• Build and extend fine-grained permissions for tokens and roles so additional resources have permission coverage consistent with the established catalog.
• Extend and fix authorization enforcement so GraphQL and the REST API enforce the intended permissions consistently.
• Make incremental refactors to long-lived policy code without changing behavior for existing customers.
• Investigate and fix reliability, performance, and security issues so affected permission checks return the expected results without regressions.
• Work with the authentication, platform, and artificial intelligence (AI) teams to document interface contracts that keep permission checks consistent as authorization moves toward a shared service.
• Contribute to design documents, merge requests, and code reviews so proposed changes have a documented rationale and review feedback is addressed asynchronously.

What you'll need

• Solid experience building and maintaining production Ruby on Rails applications, typically gained over 2 to 4 years or more.
• Hands-on experience with authorization concepts, such as role-based access control or fine-grained permissions, from work or projects.
• A security mindset: you treat a permission bug as a security bug and consider who a change could affect before choosing an implementation.
• Experience making careful changes to existing codebases, including incremental refactors and feature-flagged rollouts that preserve existing behavior.
• Familiarity with GraphQL or API authorization patterns.
• Awareness of performance, including how repeated permission checks can add up on every request.
• Strong written communication and the ability to work effectively when most decisions happen in a document or merge request rather than a meeting.

Nice to have

• Hands-on PostgreSQL experience.
• Experience with Rust, gRPC or Protocol Buffers, Cedar or other policy languages, Zanzibar-style authorization systems, Go, or service-oriented architecture.
• Transferable experience from adjacent domains such as identity, policy engines, and platform security.

Details

• Location: Bangalore, India.
• Fully asynchronous organization; most decisions are made in documents or merge requests rather than meetings.
• Employment type: full-time (benefits listed for full-time employees).