[Hiring] Threat Research Engineer @GitLab

Role Description

As a Threat Research Engineer, you’ll take ideas from the first question to a working proof of concept, deploy it, and analyze the results yourself. This is a full-stack role, with AI central to how we work. You’ll build agentic workflows for research, analysis, and detection, and use AI tools every day to move faster.

What you’ll do

• Research new attack surfaces and threat vectors, including AI coding agents, agent plugins, and package ecosystems.
• Find and responsibly disclose vulnerabilities in open source projects and developer tools.
• Analyze software supply chain incidents and events.
• Build AI-powered workflows and agents that automate research, analysis, and detection.
• Build and maintain the cloud-based systems behind our detection and advisory work.
• Improve the quality and coverage of our vulnerability and malware advisories.
• Write up your findings as blog posts and present them at conferences.
• Take part in on-call or operational support where your team's ownership model requires it.

Qualifications

• Hands-on security experience in research, malware analysis, penetration testing, or security tooling, with both a developer mindset and an adversarial mindset.
• Demonstrated experience using AI in real work, such as building with large language model APIs or agent frameworks like LangChain, LangGraph, or agent SDKs.
• Strong programming skills in Go or Python, with good software engineering practices including testing, code review, continuous integration and continuous delivery, and maintainable code.
• Experience deploying and running production services on a public cloud.
• Understanding of how package ecosystems work and how software supply chain attacks happen.
• Ability to map possible attack vectors, name trade-offs, and make data-driven decisions.
• Clear writing that explains findings to both engineers and a general audience.
• Helpful, but not required: published vulnerability findings; security research on AI agents, large language model applications, or Model Context Protocol (MCP) servers; Google Cloud Platform experience; or infrastructure as code experience with Terraform or OpenTofu.

Requirements

• You don’t need deep knowledge of compilers or static application security testing engines. A high-level understanding is enough.

Benefits

• Flexible Paid Time Off
• Team Member Resource Groups
• Equity Compensation & Employee Stock Purchase Plan
• Growth and Development Fund
• Parental Leave