About the company
GitLab is the intelligent orchestration platform for DevSecOps, used by more than 50 million registered users and more than 50% of the Fortune 100.
Responsibilities
- Conduct security research in two or more specialty areas
- Identify novel, systemic, and chained vulnerabilities in GitLab
- Validate security vulnerabilities through hands-on testing and proof-of-concept exploits
- Assess emerging industry vulnerability classes against the GitLab codebase and drive class-level remediation
- Conduct security research into GitLab's AI and agentic surfaces and define security requirements
- Build tooling and automation that scales security research, including agent-assisted vulnerability discovery
- Research the security posture of open source tools and dependencies, report findings, and track mitigation
- Solve technical problems of high scope, complexity, and ambiguity
- Define and implement security technical and process improvements
- Contribute to the team roadmap
- Mentor and advise other individual contributors
- Share knowledge and novel vulnerability types with the security community
Requirements
- 7+ years of experience in security research, penetration testing, or offensive security roles
- Hands-on experience discovering and exploiting vulnerabilities
- Subject matter expertise in at least two technical areas impacting product security
- Proficiency in one or more of Ruby, Go, Python, TypeScript, or Rust; AI frameworks experience is an asset
- Ability to read and analyze code across multiple languages and codebases
- Understanding of AI attack vectors including prompt injection, agent manipulation, and workflow exploitation
- Experience leading technical objectives in cross-functional teams
- Excellent written communication skills
- Ability to translate complex technical findings into clear risk assessments and remediation recommendations
- Strong analytical and problem-solving skills
- Nice to have: published security research or conference presentations; software engineering background with distributed systems; OSCP, OSCE, GPEN certifications; GitLab or similar DevSecOps experience