Top Cybersecurity Jobs

Conduct advanced application security research across GitLab’s DevSecOps and AI-powered platforms. Identify and exploit novel, systemic, and chained vulnerabilities; develop proof-of-concept exploits, testing methodologies, and research automation; assess AI attack vectors and open-source dependencies; drive remediation and security improvements; advise engineering teams, contribute to roadmaps, mentor researchers, and share findings with the security community.

Conducts advanced application security research across GitLab’s DevSecOps and AI-powered platforms. Responsibilities include discovering and exploiting systemic vulnerabilities, penetration testing, developing proof-of-concept exploits, researching AI and agentic security threats, building automated research tooling, coordinating remediation, mentoring security professionals, and communicating findings to engineering and security communities.

Lead public sector security compliance initiatives, including FedRAMP continuous monitoring, audits, certifications, GRC strategy, compliance automation, documentation, customer support, and regulatory analysis. Collaborate with IT, Product, Engineering, Security, Legal, auditors, and government customers to strengthen compliance across GitLab’s SaaS and self-managed offerings.

Designs, documents, tests, and maintains IT general and security controls across corporate, engineering, SaaS, and cloud-native systems. The role maps controls across SOX, SOC 2, ISO, NIST, PCI-DSS, privacy, and contractual requirements; manages audits, access reviews, change-management testing, remediation, policy work, and evidence automation. It also establishes governance standards for enterprise AI use and partners with IT, Security, Engineering, Finance, Legal, Privacy, and auditors.

Own and evolve GitLab’s authorization systems across its Ruby on Rails monolith and next-generation Rust policy engine. Design fine-grained permissions for users, tokens, roles, and AI agents; secure GraphQL and REST APIs; lead feature-flagged rollouts and migrations; improve performance and reliability; and collaborate across authentication, platform, AI, and modular-service teams in a distributed asynchronous environment.

Owns GitLab’s global security awareness and human-risk program, including training, phishing simulations, behavior-change initiatives, security culture campaigns, multimedia content, platform administration, reporting, vendor management, policy support, audit evidence, and remediation tracking. The role requires measurable risk reduction across a globally distributed enterprise and strategic influence across technical and non-technical teams.

Lead infrastructure security for GitLab’s FedRAMP and federal cloud environments. Set technical direction, architecture, security automation, and compliance patterns; own security posture; lead threat modeling, security reviews, continuous monitoring, and authorization-impacting initiatives. Partner with SRE, engineering, compliance, and leadership to drive remediation and roadmap decisions. Apply AI to constrained security workflows, mentor engineers, and influence security practices across GitLab offerings.

Lead enterprise IAM and AI access security engineering across Okta, GCP, AWS, and IGA platforms. Replace low-code automation with tested Python services, codify identity infrastructure using Terraform/OpenTofu/Pulumi, implement least-privilege and privileged-access controls, govern human and non-human identities, and secure enterprise AI platforms. Drive cross-functional initiatives, develop technical roadmaps and proposals, support compliance, and mentor engineers.

Build and improve GitLab authentication services across Ruby on Rails and Go codebases. Design token issuance, validation, identity, access management, passwordless authentication, workload identity federation, and secure automation features. Migrate authentication paths to GATE while supporting multiple deployment models, address reported vulnerabilities, optimize performance, review code, establish engineering standards, and collaborate on complex projects in a remote, asynchronous environment.

Lead end-to-end incident response for high-severity security events across cloud environments, perform DFIR investigations, build detection and automation (including AI-assisted) workflows, partner cross-functionally, produce executive communications and RCAs, maintain runbooks/playbooks, and mentor other engineers within a 24/7 global on-call model.