Senior Technical Architect (Security) for Professional Services responsible for designing and delivering secure GitLab architectures (SaaS, Self-Managed, Dedicated), conducting security risk assessments and threat modeling, leading CI/CD and security-tool migrations, and advising customers on compliance frameworks such as NIST 800-53, ISO 27001, and SOC 2. Role requires hands-on experience with infrastructure as code (Ansible, Terraform), GitLab security scanning capabilities, and integrating security controls into CI/CD pipelines.

Join GitLab's Security Incident Response Team to lead incident detection and response in a 24/7 rotation (compressed 4-day workweek, shifts Sun–Wed). Responsibilities include incident management from detection through recovery, maintaining runbooks and documentation, conducting post-incident RCA, implementing security automation and detection improvements, and collaborating across teams. Experience with SIEM/logging, cloud platforms (GCP and/or AWS), Python (or willingness to learn), and forensic/cloud investigations is expected or encouraged.

Remote staff security researcher role focused on identifying, validating, and remediating novel and systemic vulnerabilities in GitLab's DevSecOps platform, including AI agents and workflows. Requires 7+ years in security research or offensive roles, hands-on exploit development, proficiency with one or more of Ruby, Go, Python, TypeScript, or Rust, and experience with AI attack vectors. Position reports to the Senior Manager of Application Security; US base salary range listed.

Lead and conduct advanced security research and penetration testing across GitLab's platform and AI/agent surfaces, develop testing methodologies and tooling, validate vulnerabilities with proof-of-concept exploits, drive class-level remediations, mentor others, and coordinate cross-functional remediation. Role expects 10+ years' relevant experience and proficiency in two or more of Ruby, Go, Python, TypeScript, or Rust. US base salary range listed: $203,200–$275,000 USD (for US residents).

Role to develop and manage GRC strategies, lead security assessments and certification processes (e.g., FedRAMP, CMMC, SOC 2, ISO 27001), implement compliance-as-code solutions, and support GitLab Dedicated and government SaaS offerings. Requires a minimum of 5 years' relevant experience, familiarity with cloud hyperscalers (AWS/GCP), scripting/automation skills, and valid proof of U.S. citizenship and residency. Position is remote for U.S.-based candidates.

Lead the technology compliance program for systems that run the business: design and test IT General Controls and security controls (SOX, SOC 2, ISO 27001, NIST CSF, PCI-DSS), automate evidence collection, liaise with IT, Engineering, Finance, and auditors, set standards for governed AI use, and drive remediation and policy work across the estate. Requires 5+ years in IT/security/compliance or audit experience.

Work includes owning end-to-end workstreams to design, implement, and roll out fine-grained token permissions, custom roles, and policy enforcement across GraphQL and REST; refactoring policy code so it can be evaluated by both the monolith and a Rust policy engine (Zanzibar-style tuples and Cedar policies); improving reliability, performance, and security of authorization systems; and collaborating with authentication, platform, AI, and modular-service teams. Role is remote and listed locations include Canada, Israel, the United Kingdom, and the United States.

Lead technical direction and hands-on implementation of infrastructure security for GitLab's FedRAMP environment and GitLab Dedicated for Government. Responsibilities include architecting security patterns and automation, owning FedRAMP security posture, threat modeling and security reviews, partnering with Public Sector SRE and stakeholders, and mentoring engineers. Requires US citizenship and residence.

Owner of delivery workstreams on federal engagements: install, configure, upgrade, and troubleshoot GitLab in cloud, on-premises, and disconnected/air-gapped environments; perform migrations from Bitbucket/GitHub/Jenkins; configure against federal security baselines (DISA STIG, FIPS, FedRAMP, NIST); run enablement and support authorization artifacts. Role is remote but available only to candidates in the Washington, DC metropolitan area and requires an active Top Secret/Sensitive Compartmented Information (TS/SCI) clearance.

Lead and evolve a global security awareness and education program (annual, new-hire, role-based, targeted, executive, microlearning), run enterprise-scale phishing simulations, apply behavior-change techniques, produce multimedia content, manage related vendors, administer training/phishing platforms, and coordinate audit evidence. Requires a minimum of 10 years' relevant experience and demonstrated outcomes.

Senior technical leader on the Corporate Security Identity Team responsible for designing enterprise-scale identity and AI access solutions, migrating click-ops to infrastructure-as-code (Terraform/OpenTofu/Pulumi), building Python services (GCP Cloud Run), re-architecting identity across GCP and AWS, leading non-human identity and AI platform governance (Anthropic Claude, ChatGPT Enterprise, Gemini), and mentoring engineers. Requires deep Okta expertise, cloud identity experience, IGA platform familiarity, and experience in regulated environments.

Remote Staff Corporate Security Engineer on GitLab's Corporate Security Engineering team focused on securing endpoints and supporting SaaS platforms, with a primary emphasis on macOS. Responsibilities include designing endpoint hardening and lifecycle automation, managing security configuration via Terraform and GitOps workflows, improving telemetry and detections, and mentoring engineers. Role is expected to strengthen endpoint security architecture, expand automation, and improve auditability of controls.

Lead the Security Posture Management (SPM) team to drive governed rollouts of GitLab's security capabilities, establish proactive software supply chain security (including SBOMs and third-party component governance), manage the Product Security Risk Register, and partner with Compliance for audit evidence. The role requires experience managing security or engineering teams, technical fluency in security posture and supply chain security, and the ability to drive adoption across engineering teams in a remote, asynchronous environment.

Work on GitLab's Vulnerability Management team to develop and maintain backend features (primarily Ruby on Rails) for security dashboards, vulnerability reports, and ingestion pipelines. Collaborate with frontend engineers, product, and design; participate in code reviews and on-call rotations; and help improve performance, reliability, and scalability of security data systems.

Engineer security improvements to GitLab product and maintain in-house abuse prevention platform (Ruby on Rails). Build anomaly detection and prevention systems, expand agentic AI capabilities for mitigation, collaborate with peer teams on safety improvements, and create documentation and runbooks. Strong Ruby/Rails, cloud-native (GCP/AWS), automation, and interest in security/abuse mitigation are required.

Remote Senior Security Engineer (EMEA) on GitLab’s SIRT operating a compressed 4-day, shift-based schedule to provide 24/7 coverage. Responsibilities include leading high-severity incident response and DFIR investigations, designing detection (SIEM/EDR) and telemetry pipelines, building automation and AI-assisted workflows, partnering with threat intelligence and engineering teams, conducting RCAs and post-incident reviews, and mentoring other engineers.

The Director of Engineering, Security Factory will set the engineering vision and roadmap across nine distributed teams building proprietary security scanners, AI/ML detection engines, agentic remediation flows, and supporting security foundations. The role includes leading managers and engineers, driving architecture and delivery decisions, partnering with product management, and representing the group in cross-functional and customer-facing contexts within a remote, async-first organization.

Join GitLab's Infrastructure Security team to lead architecture, automation, threat modeling, and delivery of security capabilities across SaaS and self-managed platforms. The role combines hands-on implementation (cloud, Kubernetes, IaC, security tooling, AI-assisted workflows) with cross-team technical leadership and mentorship.