Senior Software Engineer, Security Factory: Code Security

Remote · Canada · United States of America · USD 139,200-235,200 · Posted Oct 10, 2026

At a glance

As a Senior Backend Engineer on GitLab's Security Factory: Code Security team, you help developers find and fix security issues in the code they write and the open source components they depend on.
Your work spans complementary parts of a complete security analysis, including dependency analysis and vulnerability detection.
You make thoughtful use of AI-assisted development tools in your daily work, incorporating AI as a core productivity multiplier.

Act as the directly responsible individual (DRI) for team initiatives from design through delivery, shipping with minimal guidance in partnership with the technical lead
Bring systems built by one engineer to team ownership through documentation, tests, and shared review
Design and ship analyzers that pair deterministic analysis capabilities with AI-driven analysis, and build the evaluation harnesses that measure their false positives and missed findings
Package those analyzers for every place GitLab runs them, including CI jobs, AI agent workflows, and command-line tools
Design and ship the manifest, lockfile, and SBOM parsing that tells the static analysis engine what a project depends on, and extend it to new ecosystems and formats
Ship features across the automated remediation service that turns security advisories into dependency update merge requests
Solve technical problems of high scope and complexity, actively seek out difficult impediments affecting the whole team, and advocate for improvements to quality, security, and performance
Mentor Intermediate engineers through code review and pairing, and maintain our internal standards for style, maintainability, and best practices through review
Participate in on-call rotations to assist troubleshooting product operations, security operations, and urgent engineering issues

Experience building your own LLM tooling, such as a harness, an agent pipeline, or evaluations
Substantial professional experience writing and testing production code in a systems language, particularly Go and/or Rust, with depth in at least one
Familiarity with package managers and dependency management in one or more language ecosystems, such as npm, Maven, pip, Bundler, or Cargo
Demonstrated application security experience, such as vulnerability research, secure code review, or writing detection rules, and fluency with vulnerability classes and the software supply chain
A track record of taking ownership of ambiguous problems and shipping with minimal guidance
Demonstrated capacity to communicate clearly and concisely about technical problems, and to write design proposals that bring a team to a decision

Experience evaluating AI-driven detection against labeled data, including measuring false positives and missed findings
Experience with performance optimization at scale
Hands-on program analysis experience, such as parsing, ASTs, or data-flow analysis
Familiarity with popular web or mobile application frameworks and how they handle input, data, and configuration
Experience with containerized workflows and CI/CD

Remote-Global work environment with asynchronous work across time zones
All roles are remote, though some roles may carry specific location-based eligibility requirements