Threat Research Engineer, Security Factory: Threat Research

Overview

Threat Research Engineer on GitLab's Threat Research team, taking research ideas from first question to working proof of concept, deploying and analyzing results. Full-stack role with AI central to how the team works.

What you'll do

• Research new attack surfaces and threat vectors, including AI coding agents, agent plugins, and package ecosystems.
• Find and responsibly disclose vulnerabilities in open source projects and developer tools.
• Analyze software supply chain incidents and events.
• Build AI-powered workflows and agents that automate research, analysis, and detection.
• Build and maintain the cloud-based systems behind detection and advisory work.
• Improve the quality and coverage of vulnerability and malware advisories.
• Write up findings as blog posts and present them at conferences.
• Take part in on-call or operational support where the team's ownership model requires it.

What you'll need

• Hands-on security experience in research, malware analysis, penetration testing, or security tooling, with both a developer mindset and an adversarial mindset.
• Demonstrated experience using AI in real work, such as building with large language model APIs or agent frameworks like LangChain, LangGraph, or agent SDKs.
• Strong programming skills in Go or Python, with good software engineering practices including testing, code review, continuous integration and continuous delivery, and maintainable code.
• Experience deploying and running production services on a public cloud.
• Understanding of how package ecosystems work and how software supply chain attacks happen.
• Ability to map possible attack vectors, name trade-offs, and make data-driven decisions, balancing quality and speed with customer outcomes in mind while keeping up with security and AI industry trends.
• Clear writing that explains findings to both engineers and a general audience.

Nice to have

• Published vulnerability findings.
• Security research on AI agents, large language model applications, or Model Context Protocol (MCP) servers.
• Google Cloud Platform experience.
• Infrastructure as code experience with Terraform or OpenTofu.

Details

• Remote; location eligibility listed as Israel, Poland, and United Kingdom.
• Poland base salary range: 272,000 - 408,000 PLN (base salary only; excludes bonuses, equity, and benefits).