Senior Software Engineer (Ruby), Security Platform: Authorization

Overview

Senior Software Engineer on GitLab’s Authorization team, owning key parts of the system that controls what users, tokens, and automated agents can access across GitLab.com and self-managed deployments.

What you'll do

• Design and ship authorization changes in the Ruby on Rails monolith.
• Own an end-to-end workstream from problem definition to feature-flagged rollout and dual-run verification.
• Build and extend fine-grained permissions for tokens and roles while keeping the permission catalog coherent.
• Extend and harden authorization enforcement across GraphQL and REST APIs.
• Refactor policy code so both the monolith and a new authorization engine can evaluate it without changing existing behavior.
• Improve reliability, performance, and security posture of existing authorization systems, including permission-model debt.
• Drive technical decisions via design docs, architecture decision records, and code review in an asynchronous organization.

What you'll need

• Significant experience building and operating production Ruby on Rails applications.
• Experience designing or implementing authorization systems, including role-based access control and fine-grained permissions.
• A security mindset focused on treating permission bugs as security bugs and reasoning about blast radius.
• Comfort making careful changes to large, long-lived codebases.
• Working knowledge of GraphQL and API authorization patterns.
• Attention to performance at scale when permission checks run frequently.
• Strong written communication for decisions made in documents and merge requests.

Details

• Location: Remote (Canada, Israel, United Kingdom, United States).