Staff Software Engineer, Security Factory: Static Analysis

Remote · Israel · United States of America · USD 152,800-259,200 · Remote · Posted Oct 10, 2026

At a glance

The Staff Backend Engineer on the Security Factory: Code Scanning team sets the technical direction for GitLab's static analysis engine.
This role involves architecting program models, defining specifications for AI agents to implement, and building tooling to validate security findings against known vulnerabilities.

Act as the directly responsible individual (DRI) for the team's highest-scope initiatives from design through delivery.
Set the technical direction for AI-assisted tooling that implements, reviews, and validates engine changes.
Own the architecture of the program model, including parsing, symbol resolution, intermediate representations, and call graphs.
Define how the engine and pipeline extend to new languages and frameworks.
Design checks to determine if agent-written code or generated results are fit to merge.
Measure detection quality against benchmark applications with known vulnerabilities.
Mentor engineers through code review and pairing to remove blockers and improve internal standards.
Participate in on-call rotations for product and security operations.
Define overarching architecture and specification documents, delegating components to engineers and AI agents.
Stay current with research in program analysis and security, turning findings into prototypes and proposals.

Extensive professional experience writing, testing, and reviewing production code in Rust, Go, or a comparable systems language.
Experience building LLM tooling, such as harnesses, agent pipelines, or evaluations.
Deep program analysis and static analysis background, including parsing, ASTs, intermediate representations, and taint/data-flow analysis.
Deep application security experience, including vulnerability research, secure code review, and fluency with OWASP Top 10 and CWE.
Experience with performance optimization, containerized workflows, and CI/CD.
Demonstrated capacity to communicate complex technical and architectural problems clearly.
Track record of taking ownership of ambiguous, team-wide problems and shipping them from concept to production.
Experience defining a system's overarching architecture and delegating component specifications.
Track record of mentoring engineers and influencing technical direction.

Remote-first organization hiring in Canada, Israel, the United Kingdom, and the United States.
Relies heavily on asynchronous work across time zones.