Staff Security Researcher

Overview

GitLab is seeking a Staff Security Research Engineer for its Application Security Team to conduct security research on GitLab's AI-powered DevSecOps capabilities, including vulnerability discovery, validation, and remediation across the platform and its AI and agentic surfaces.

What you'll do

• Conduct security research in two or more specialty areas.
• Identify novel, systemic, and chained vulnerabilities in GitLab, where individual weaknesses combine for outsized impact.
• Validate security vulnerabilities through hands-on testing, developing proof-of-concept exploits that demonstrate real-world attack scenarios.
• Assess emerging industry vulnerability classes against the GitLab codebase in your areas of expertise, and drive remediation of the class rather than the instance.
• Conduct security research into GitLab's AI and agentic surfaces, and participate in defining the security requirements that engineering teams build against.
• Build the tooling and automation that scales security research, including agent-assisted vulnerability discovery across our codebase.
• Research the security posture of open source tools and dependencies integrated with GitLab, report findings to their maintainers, and track mitigation following our responsible disclosure guidelines.
• Solve technical problems of high scope, complexity, and ambiguity.
• Define and implement security technical and process improvements.
• Contribute to the team roadmap.
• Provide actionable and constructive feedback to the engineering teams that need to act on your findings.
• Mentor and advise other individual contributors within the team, and sometimes outside of it.
• Share knowledge and novel vulnerability types with the security community.

What you'll need

• 7+ years of experience in security research, penetration testing, or offensive security roles.
• Hands-on experience discovering and exploiting vulnerabilities.
• Be a subject matter expert (SME) of at least two technical areas impacting the security of the product.
• Proficiency in one or more of Ruby, Go, Python, TypeScript, or Rust.
• Ability to read and analyze code across multiple languages and codebases.
• Understanding of AI attack vectors including prompt injection, agent manipulation, and workflow exploitation.
• Experience leading technical objectives in cross-functional teams.
• Excellent written communication skills with an ability to articulate complex topics in a clear and concise manner.
• Ability to translate complex technical findings into clear risk assessments and remediation recommendations.
• Strong analytical and problem-solving skills with creative thinking about attack scenarios.

Nice to have

• Experience in AI frameworks is an asset.
• Published security research or conference presentations.
• Background in software engineering with distributed systems expertise.
• Security certifications such as OSCP, OSCE, GPEN, or similar.
• Experience with GitLab or similar DevSecOps platforms.

Details

• Reports to the Senior Manager of Application Security.
• Remote; hiring locations include Canada, Israel, the United Kingdom, and the United States.
• United States base salary range: $168,000 – $238,000 USD (base salary only, excluding bonuses, equity, and benefits).