Staff Software Engineer, Security Factory: Static Analysis

Overview

You join GitLab as a Staff Backend Engineer on the Security Factory: Code Scanning team to shape the static analysis engine that detects security issues in code. You own long-range technical goals, architecture, and AI-assisted tooling, guiding engineers and AI agents alike. You will ensure trustworthy results through rigorous evaluation, tests, and benchmarks against known vulnerabilities. You collaborate across product, UX, and security teams to raise quality, security, and performance. This role offers influence over core security capabilities in a high-impact, globally distributed environment.

Pay / Benefits

• Flexible Paid Time Off
• Team Member Resource Groups
• Equity Compensation & Employee Stock Purchase Plan
• Growth and Development Fund
• Parental Leave

Responsibilities

• Act as directly responsible for high-scope initiatives from design to delivery, shipping large features with minimal guidance
• Transition individual-engineer work to team ownership via documentation, tests, and shared review
• Set technical direction for AI-assisted tooling, define checks for agent-written changes, and measure detection quality against benchmarks
• Own the architecture of the program model (parsing, symbol resolution, IRs, call graphs, taint/data-flow) and the pipeline from source to findings
• Define how engine models extend to new languages/frameworks and coordinate implementation by engineers and AI agents
• Solve top-level technical problems, advocate for quality, security, and performance improvements with cross-functional partners
• Mentor engineers through code review, unblock autonomy, and codify internal standards
• Participate in on-call rotations for product and security operations
• Define architecture/spec documents and drive implementations by AI agents and engineers in phased, reviewable changes
• Build and maintain harnesses, agent instructions, and governance for agent-written code, including safety gates and independent reviews
• Stay current with program analysis and security research, turning findings into prototypes and upstream contributions

Key requirements

• Experience building own LLM tooling (harness, agent pipeline, evaluations) with trustworthiness judgment
• Extensive production experience in Rust, Go, or equivalent systems language with depth in at least one
• Experience with performance optimization and containerized CI/CD pipelines (Docker)
• Deep background in program analysis and static analysis (parsing, ASTs, IRs, taint/data-flow, type inference, fixpoint computation)
• Deep application security experience (vulnerability research, secure code review, detection rules; OWASP CWE familiarity)
• Ability to communicate complex technical issues clearly and write architectures and design specs
• Track record of owning ambiguous problems and delivering from concept to production with asynchronous updates
• Experience defining overarching architecture and delegating specs to engineers and AI agents
• Mentoring experience and history of raising a team's technical bar and guiding direction

• Clear, concise communication
• Collaborative problem-solving
• Mentorship and team enablement
• Rust
• Go
• C/C++ or other systems language (Ruby experience is mentioned as integration layer)