Staff Security Researcher

Overview

As Staff Security Research Engineer on the Application Security Team, you will lead cutting-edge security research for GitLab’s AI-powered DevSecOps platform. You will develop novel testing methodologies, perform hands-on penetration testing, and translate threats into actionable improvements. Your work helps shape the security posture of our AI-enabled software factory. This role offers impact across engineering, security, and open collaboration with the security community.

Pay / Benefits

• Flexible Paid Time Off
• Team Member Resource Groups
• Equity Compensation & Employee Stock Purchase Plan
• Growth and Development Fund
• Parental Leave

Responsibilities

• Conduct security research across multiple specialty areas
• Identify systemic vulnerabilities and validate via hands-on testing with PoCs
• Assess new vulnerability classes and drive remediation
• Research AI/agentic surfaces and define security requirements for engineering
• Build tooling and automation to scale security research
• Evaluate open source dependencies and coordinate responsible disclosure
• Solve high-scope technical problems and improve security processes
• Contribute to team roadmap and mentor contributors
• Share knowledge with the security community

Key requirements

• 7+ years in security research, penetration testing, or offensive security
• SME in at least two technical areas impacting GitLab security
• Proficiency in Ruby, Go, Python, TypeScript, or Rust
• Code-reading ability across multiple languages
• Understanding of AI attack vectors (prompt injection, agent manipulation, workflow exploitation)
• Experience leading technical objectives in cross-functional teams
• Excellent written communication and ability to translate findings into risk and remediation

• excellent written communication
• analytical and creative problem-solving
• leadership in cross-functional teams
• Ruby
• Go
• Python

…