[Hiring] Intermediate Backend Engineer @GitLab

Role Description

As an Intermediate Backend Engineer on GitLab's Security Factory: Code Security team, you'll help developers find and fix security issues in the code they write and the open source components they depend on.

• Your work connects dependency analysis, vulnerability detection, and automated remediation.
• You'll build parsing that tells the security analysis engine which libraries and frameworks a project uses.
• Extend a service that turns security advisories into dependency update merge requests.
• Develop hybrid analyzers that combine rule-based detection with artificial intelligence (AI) reasoning.
• Help evaluate how well those analyzers find real vulnerabilities and expand coverage of libraries, frameworks, and AI agent tooling.
• We use AI-assisted development tools in our daily work and expect you to use them effectively and with good judgment.

What you’ll do

• Develop secure, well-tested, performant parsing for dependency manifests, lockfiles, and software bills of materials (SBOMs).
• Extend support for new package ecosystems and formats in the analysis engine and remediation service.
• Build and apply analyzers that combine deterministic analysis with AI-driven analysis, working with the team's technical leadership.
• Review results and measure false positives and missed findings against benchmark applications with known vulnerabilities.
• Create detection rules mapped to Common Weakness Enumeration (CWE) and the test fixtures that prove they work.
• Contribute to packaging analyzers for continuous integration (CI) jobs, AI agent workflows, and command-line tools, reporting findings in GitLab's standard security report formats.
• Extend the automated remediation service, from running dependency updates in a sandbox to opening merge requests.
• Solve technical problems of moderate scope and complexity.
• Identify technical debt that slows the team down, and propose and implement improvements.
• Write maintainable code that meets our internal standards, and help maintain those standards through code review.
• Participate in on-call rotations to troubleshoot product operations, security operations, and urgent engineering issues.

What you’ll bring

• Experience using AI or large language model (LLM) tools to generate or evaluate technical content, with the judgment to know when output is trustworthy and when it isn't.
• Solid professional experience writing and testing production code in a systems language, particularly Go and/or Rust.
• A willingness to learn how vulnerabilities arise in code and the software supply chain.
• Ability to explore common vulnerability classes such as the Open Worldwide Application Security Project (OWASP) Top 10 and CWE, and apply static analysis to detect them.
• The ability to organize your work and follow through on tasks independently in a remote, largely asynchronous environment.
• The ability to communicate clearly and concisely about technical problems and propose iterative solutions.
• Helpful, but not required: experience with containerized workflows and continuous integration and continuous delivery (CI/CD), or a willingness to learn them; package managers and dependency tooling such as npm, Maven, pip, Bundler, or Cargo; web or mobile frameworks; parsing, abstract syntax trees (ASTs), program analysis, or detection rules; or evaluating AI-driven detection against labeled data.

About the team

• The Security Factory: Code Security team builds GitLab's code-level security scanning capabilities, spanning static application security testing (SAST) and dependency scanning.
• We work closely with the Static Analysis team on GitLab's SAST engines, with Composition Analysis on the broader software supply chain, and with other groups across the Sec section.
• We rely heavily on asynchronous work across time zones.

Benefits

• Flexible Paid Time Off
• Team Member Resource Groups
• Equity Compensation & Employee Stock Purchase Plan
• Growth and Development Fund
• Parental Leave