Principal Security Researcher

Responsibilities

• Conduct and lead security research projects across multiple functional areas.
• Identify novel, systemic, and chained vulnerabilities in GitLab and validate them through hands-on testing.
• Develop proof-of-concept exploits demonstrating real-world attack scenarios.
• Assess emerging vulnerability classes against the GitLab codebase and drive systemic remediation.
• Lead security research into AI and agentic surfaces, defining security requirements for engineering teams.
• Build and direct tooling and automation for scalable security research, including agent-assisted vulnerability discovery.
• Research the security posture of open-source tools and dependencies, report findings to maintainers, and track mitigation.
• Solve highly complex, ambiguous technical problems and help shape team and sub-department roadmaps.
• Integrate security research findings into engineering and business functions.
• Teach, mentor, and advise security and engineering contributors.
• Share knowledge and novel vulnerability types with the security community.

Requirements

• 10+ years of experience in security research, penetration testing, or offensive security.
• Strong ability to discover and exploit vulnerabilities in large codebases and complex systems.
• Proficiency in at least two of Ruby, Go, Python, TypeScript, or Rust.
• Ability to read and analyze code across multiple languages and codebases.
• Strong knowledge of AI frameworks and AI attack vectors, including prompt injection, agent manipulation, and workflow exploitation.
• Ability to establish and drive complex, cross-functional remediation initiatives.
• Excellent written communication and ability to explain complex topics clearly.
• Ability to translate technical findings into risk assessments and remediation recommendations.
• Strong analytical, problem-solving, and creative attack-scenario development skills.

Nice to Have

• Published security research or conference presentations.
• Software engineering background with distributed-systems expertise.
• Experience with GitLab or similar DevSecOps platforms.

Compensation and Benefits

• United States base salary: $203,200–$275,000 USD.
• Base salary excludes bonuses, equity, and benefits.
• Benefits include flexible paid time off, team member resource groups, equity compensation and employee stock purchase plan, growth and development funding, and parental leave.