14 hours ago
Remote, United Kingdom +2 moreSenior
Responsibilities
- Research emerging attack surfaces and threat vectors, including AI coding agents, agent plugins, and package ecosystems.
- Find and responsibly disclose vulnerabilities in open source projects and developer tools.
- Analyze software supply chain incidents and events.
- Build AI-powered workflows and agents that automate research, analysis, and detection.
- Build and maintain cloud-based systems supporting detection and security advisories.
- Improve the quality and coverage of vulnerability and malware advisories.
- Write findings as blog posts and present them at conferences.
- Participate in on-call or operational support as required by the team’s ownership model.
Requirements
- Hands-on security experience in research, malware analysis, penetration testing, or security tooling, with both development and adversarial perspectives.
- Demonstrated experience using AI in real work, including large language model APIs or agent frameworks such as LangChain, LangGraph, or agent SDKs.
- Strong programming skills in Go or Python and sound software engineering practices, including testing, code review, continuous integration and continuous delivery, and maintainable code.
- Experience deploying and operating production services on a public cloud.
- Understanding of package ecosystems and software supply chain attacks.
- Ability to assess attack vectors, trade-offs, and data-driven decisions while balancing quality, speed, and customer outcomes.
- Strong technical and general-audience writing skills.
- Preferred qualifications include published vulnerability findings, security research on AI agents or large language model applications, Model Context Protocol server research, Google Cloud Platform experience, and Terraform or OpenTofu infrastructure-as-code experience.
- Deep compiler or static application security testing engine knowledge is not required; high-level familiarity is sufficient.
Benefits
- Health, financial, and well-being benefits.
- Flexible paid time off.
- Team Member Resource Groups.
- Equity compensation and Employee Stock Purchase Plan.
- Growth and Development Fund.
- Parental leave.
- Fully remote work arrangement, subject to location-based eligibility requirements.
Tech Stack
Categories
About GitLab
GitLab builds a DevSecOps platform that unifies source code management, CI/CD, and security with AI-assisted workflows for software teams and enterprises. It sells cloud-hosted and self-managed subscriptions, plus enterprise features and support. Founded in 2014 and headquartered in San Francisco, GitLab is a public company listed on NASDAQ and is widely used by large enterprises, including many in the Fortune 100.