Intermediate Security Engineer, Security Incident Response Team (SIRT)

Overview

Intermediate Security Engineer for GitLab’s Security Incident Response Team (SIRT), supporting 24/7 incident detection and response for GitLab.com and GitLab.

What you'll do

• Lead security incident response during scheduled shifts in a 24/7 global rotation.
• Manage incidents from detection through containment and recovery.
• Create and maintain incident response documentation, including runbooks and standard procedures.
• Conduct post-incident analysis via RCA and lessons-learned reviews.
• Design and implement automated security processes to reduce manual effort.
• Identify security gaps and implement advanced detection and response capabilities.
• Collaborate with GitLab teams to deliver security infrastructure projects.

What you'll need

• Demonstrated ability to learn and lead incident response processes independently.
• Experience with SIEM/security logging tools.
• Experience with cloud platforms (GCP and/or AWS).
• Python programming skills or strong willingness to learn.
• A passion for technical documentation.
• Proactive approach to identifying and investigating security threats.

Details

• Work schedule: compressed 4-day week; shifts run Sunday–Wednesday or Wednesday–Saturday for 24/7/365 coverage.
• Location: Remote, Australia.