Salary not listed
Staff Software Engineer, Security Platform: Authentication
BackendRemote — Bangalore, India
Published on 2026-11-11
These details were extracted automatically from the original listing. They may not be complete or fully up to date — it's worth checking the original job post.
About this role
Lead technical direction for authentication protocols and identity systems across GitLab’s Rails monolith and GATE services. Drive secure, backward-compatible migrations and help build identity capabilities for multi-cell organizations, AI agents, and workloads.
About the company
GitLab is a DevSecOps platform that brings source control, CI/CD, security, and project management into a single application. It helps engineering teams plan, build, secure, and ship software faster.
The team
Authentication group within GitLab’s Security Platform stage.
Stack
Ruby on RailsGoOAuth 2.0OpenID Connect (OIDC)SAML 2.0LDAPJWTGATE
What you'll do
- Set technical direction for authentication protocols across the monolith and GATE services.
- Write architecture documents and break multi-quarter initiatives into feature-flagged releases.
- Lead customer-safe migrations of tokens, client and grant state, and session behavior.
- Threat-model authentication flows, implement abuse controls, and lead technical incident response.
- Coordinate interface contracts with GATE, Authorization, and Tenant Scale teams.
- Mentor engineers and review designs and code.
- Provide on-call or operational support as required.
What we're looking for
- Production experience building and operating authentication or identity systems at scale.
- Deep knowledge of OAuth 2.0 and OIDC, including PKCE, refresh-token rotation, token exchange, scopes, and JWT key management.
- Working knowledge of SAML 2.0 and enterprise identity integration.
- Strong production experience with Ruby on Rails or Go, and willingness to work in both.
- Experience with backward-compatible migrations and feature-flagged rollouts in large codebases.
- Security-focused approach to token theft, replay, revocation, and blast radius.
- Experience with multi-tenant SaaS systems and clear written communication in an asynchronous remote environment.
Nice to have
- Experience with Doorkeeper, Devise, or OmniAuth.
- Passkeys, multi-factor authentication, workload identity, gateways, or policy engines.
- AI agent authentication or multi-region architectures.
- Contributions to identity standards or open-source identity projects.
Benefits
- Flexible paid time off
- Equity compensation and employee stock purchase plan
- Growth and development fund
- Parental leave
- Team member resource groups