Staff Software Engineer, Security Factory: Static Analysis

Sets technical direction for the static analysis engine behind GitLab's SAST product as a staff backend engineer on the Security Factory: Code Scanning team. The engineer owns the architecture of the program model, from parsing and symbol resolution to call graphs and taint tracking, writes the specifications that engineers and AI coding agents implement, and designs the guardrails and review harnesses that decide whether agent-written code can merge. Detection quality is measured against benchmark apps with known flaws, and SAST rules are mapped to CWE and OWASP.

The team wants deep program analysis expertise, extensive production Rust or Go, strong application security knowledge, experience building LLM tooling, and a record of mentoring engineers. Remote in the US, Canada, the UK or Israel.