Staff Software Engineer, Security Platform: Authentication

Overview

As a Staff Software Engineer on GitLab's Authentication team, you will be the technical lead for how every user, application, token, and automated agent proves its identity across GitLab.com, Self-Managed, and Dedicated.

What you'll do

• Own the technical direction for authentication protocols at GitLab, including OAuth 2.0, OIDC, SAML, and token exchange, across the Rails monolith and GATE services.
• Write and drive design documents and architecture decision records (ADRs) for multi-quarter work, then break that work into increments that ship behind feature flags.
• Lead migrations that must not break existing customers: token formats, client and grant state, and session behavior on GitLab.com, Self-Managed, and Dedicated.
• Be hands-on in the most complex parts of the code, in Ruby on Rails and Go, and review the designs and merge requests of other engineers.
• Agree interface contracts with the GATE Core, GATE Infra, Authorization, and Tenant Scale (Cells and Organizations) teams, and keep them current as the architecture changes.
• Treat authentication as a security and availability boundary: threat-model new flows, add rate limits and abuse controls, and lead the technical response to authentication incidents.
• Mentor senior and intermediate engineers on the team and raise the protocol and security knowledge of the whole group.
• Work asynchronously with engineers in India, Europe, and the Americas, with most decisions made in writing.
• Take part in on-call or operational support where your team's ownership model requires it.

What you'll need

• Significant experience building and running production authentication or identity systems at scale, with technical leadership across teams that moves unclear problems to written decisions and shipped code.
• Deep, hands-on knowledge of OAuth 2.0 and OIDC: authorization code with Proof Key for Code Exchange (PKCE), refresh token rotation, token exchange, client registration, scopes, and JSON Web Tokens (JWTs) with signing keys and key rotation.
• Working knowledge of SAML 2.0 single sign-on and enterprise identity integration (LDAP, System for Cross-domain Identity Management (SCIM), or similar).
• Strong production experience in Ruby on Rails or Go, willingness to work in both, and experience with careful refactors, feature-flagged rollouts, and backward-compatible migrations in large, long-lived codebases.
• A security mindset: you think about token theft, replay, revocation, and blast radius before you think about elegance.
• Experience with multi-tenant software as a service (SaaS) systems, including data isolation and performance under high request volume.
• Clear, concise written English and comfort working in an all-remote, asynchronous company.

Nice to have

• Experience with authentication libraries (Doorkeeper, Devise, or OmniAuth), passkeys or multi-factor authentication, workload identity, gateways or policy engines, AI agent authentication, or multi-region architectures.
• Contributions to identity standards or open source identity projects.

Details

• Location: Bangalore, India.
• All roles are remote; some roles may carry specific location-based eligibility requirements.
• Work mode: all-remote, asynchronous.