1 day ago
Bengaluru, IndiaMid Level
Responsibilities
- Extend the program model with parsing, symbol resolution, intermediate representations, call graphs, and taint and data-flow analysis for additional languages and frameworks.
- Build and apply AI-assisted tooling to implement, review, and validate static analysis engine changes and findings.
- Measure detection quality against known vulnerabilities, focusing on false-positive and false-negative rates.
- Develop SAST rules mapped to CWE and OWASP, including test fixtures that validate the rules.
- Implement component specifications with engineers and AI agents through phased, reviewable changes.
- Improve the harness, agent instructions, and safeguards used to keep agent-written code trustworthy.
- Solve moderate-scope technical problems, address technical debt, write maintainable code, and participate in code review.
- Participate in on-call rotations for product operations, security operations, and urgent engineering issues.
Requirements
- Experience using AI or LLM tools to generate or evaluate technical content and assess the trustworthiness of their output.
- Solid professional experience writing and testing production code in a systems language, particularly Rust or Go.
- Willingness to work across Rust, Go, and Ruby.
- Interest in static analysis and application security, including parsing, intermediate representations, taint and data-flow analysis, and vulnerability behavior.
- Ability to organize work independently in a remote, largely asynchronous environment.
- Ability to communicate technical problems clearly and concisely and propose iterative solutions.
- Helpful but not required: performance optimization, Docker, CI/CD, web or mobile frameworks, mutation testing, fuzzing, or program analysis and security research through publications or open source contributions.
Benefits
- Health, financial, and well-being benefits.
- Flexible paid time off.
- Team Member Resource Groups.
- Equity compensation and an Employee Stock Purchase Plan.
- Growth and Development Fund.
- Parental leave.
- Fully remote work with largely asynchronous collaboration; location-based eligibility requirements may apply.
About GitLab
GitLab builds a DevSecOps platform that unifies source code management, CI/CD, and security with AI-assisted workflows for software teams and enterprises. It sells cloud-hosted and self-managed subscriptions, plus enterprise features and support. Founded in 2014 and headquartered in San Francisco, GitLab is a public company listed on NASDAQ and is widely used by large enterprises, including many in the Fortune 100.