Senior Software Engineer, Security Factory: Code Security

A senior backend engineer on GitLab's Security Factory: Code Security team, which builds the product's SAST and dependency scanning. The work covers both halves: parsing manifests, lockfiles and SBOMs so the analysis engine knows what a project uses, and building hybrid analyzers that mix rule-based detection with AI reasoning, then benchmarking how often they miss or misfire. The engineer also ships features in the service that turns advisories into dependency update merge requests, mentors intermediate engineers and joins on-call.

The team wants strong production Go or Rust, hands-on application security work such as vulnerability research or writing detection rules, familiarity with package ecosystems, and experience building LLM tooling.