Intermediate Backend Engineer, Security Factory

About this role

Contribute to GitLab’s static application security testing engine, helping it identify vulnerabilities across programming languages and frameworks. The role also involves building AI-assisted tools and benchmarking detection quality, with human review of higher-risk changes.

About the company

GitLab is a DevSecOps platform that brings source control, CI/CD, security, and project management into a single application. It helps engineering teams plan, build, secure, and ship software faster.

The team

Security Factory: Code Scanning team

Stack

What you'll do

• Extend program parsing, symbol resolution, call graphs, and taint and data-flow analysis.
• Build tooling to evaluate findings against benchmark applications with known vulnerabilities.
• Develop SAST rules mapped to CWE and OWASP, with test fixtures.
• Implement component specifications in small, reviewable changes alongside engineers and AI agents.
• Improve agent instructions and safeguards, including performance, API, and dependency checks.
• Review code, address technical debt, and participate in on-call rotations.

What we're looking for

• Professional experience writing and testing production code in a systems language, particularly Rust or Go.
• Experience using AI or LLM tools and sound judgment in assessing their output.
• Interest in static analysis, application security, and program analysis.
• Ability to work independently in a remote, asynchronous environment and communicate technical problems clearly.

Nice to have

• Performance optimization experience.
• Docker and CI/CD experience.
• Experience with web or mobile frameworks.
• Experience with mutation testing, fuzzing, program analysis, or security research.

Benefits

• Flexible paid time off
• Equity compensation and employee stock purchase plan
• Growth and development fund
• Parental leave
• Team member resource groups