Principal Security Researcher

Overview

Principal Security Researcher on GitLab's Application Security Team, conducting security research on GitLab's AI-powered DevSecOps capabilities, including AI agent security, and reporting to the Senior Manager of Application Security.

What you'll do

• Conduct and lead security research projects across multiple functional areas.
• Identify novel, systemic, and chained vulnerabilities in GitLab, where individual weaknesses combine for outsized impact.
• Validate security vulnerabilities through hands-on testing, developing proof-of-concept exploits that demonstrate real-world attack scenarios.
• Assess emerging industry vulnerability classes against the GitLab codebase, and drive remediation of the class rather than the instance.
• Lead security research into GitLab's AI and agentic surfaces, and define the security requirements that engineering teams build against.
• Build and direct the tooling and automation that scales security research, including agent-assisted vulnerability discovery across our codebase.
• Research the security posture of open source tools and dependencies integrated with GitLab, report findings to their maintainers, and track mitigation following responsible disclosure guidelines.
• Solve technical problems of the highest scope, complexity, and ambiguity.
• Help shape the team and sub-department roadmap.
• Lead the integration of security research results into the engineering and business functions that need to act on them.
• Teach, mentor, and advise other domain experts and individual contributors across several teams.
• Share knowledge and novel vulnerability types with the security community.

What you'll need

• 10+ years of experience in security research, penetration testing, or offensive security roles.
• Strong ability in discovering and exploiting vulnerabilities in large codebases and complex systems.
• Proficiency in two or more of Ruby, Go, Python, TypeScript, or Rust.
• Ability to read and analyze code across multiple languages and codebases.
• Strong knowledge of AI frameworks.
• Strong understanding of AI attack vectors including prompt injection, agent manipulation, and workflow exploitation.
• At ease in establishing and driving complex remediation initiatives involving cross-functional teams.
• Excellent written communication skills with an ability to articulate complex topics in a clear and concise manner.
• Ability to translate complex technical findings into clear risk assessments and remediation recommendations.
• Strong analytical and problem-solving skills with creative thinking about attack scenarios.

Nice to have

• Published security research or conference presentations.
• Background in software engineering with distributed systems expertise.
• Experience with GitLab or similar DevSecOps platforms.

Details

• Remote, with locations listed as Canada, Israel, United Kingdom, and United States.
• Base salary range for the United States: $203,200 – $275,000 USD (base salary only, excluding bonuses, equity, and benefits).
• Flexible Paid Time Off, Equity Compensation and Employee Stock Purchase Plan, Growth and Development Fund, and Parental Leave are offered to full-time employees.