# Principal Security Researcher

**Company:** [GitLab](https://hotfix.jobs/companies/gitlab)
**Location:** Remote
**Role:** Security Engineering
**Salary:** $203k – $275k/yr
**Experience:** 10+ years
**Skills:** Application Security, Penetration Testing, Security Research, Offensive Security, Ruby, Go, Python, TypeScript, Rust, Ai Frameworks, Prompt Injection, Distributed Systems, DevSecOps
**Posted:** 2026-09-05

> Leads offensive security research across GitLab’s codebase and AI-powered agentic surfaces, identifying systemic vulnerabilities, developing exploit proofs of concept, and driving remediation. Requires 10+ years of security research or penetration-testing experience and proficiency in multiple programming languages.

## Job Description

## Responsibilities
- Conduct and lead security research projects across multiple functional areas.
- Identify novel, systemic, and chained vulnerabilities in GitLab and validate them through hands-on testing.
- Develop proof-of-concept exploits demonstrating real-world attack scenarios.
- Assess emerging vulnerability classes against the GitLab codebase and drive systemic remediation.
- Lead security research into AI and agentic surfaces, defining security requirements for engineering teams.
- Build and direct tooling and automation for scalable security research, including agent-assisted vulnerability discovery.
- Research the security posture of open-source tools and dependencies, report findings to maintainers, and track mitigation.
- Solve highly complex, ambiguous technical problems and help shape team and sub-department roadmaps.
- Integrate security research findings into engineering and business functions.
- Teach, mentor, and advise security and engineering contributors.
- Share knowledge and novel vulnerability types with the security community.

## Requirements
- 10+ years of experience in security research, penetration testing, or offensive security.
- Strong ability to discover and exploit vulnerabilities in large codebases and complex systems.
- Proficiency in at least two of Ruby, Go, Python, TypeScript, or Rust.
- Ability to read and analyze code across multiple languages and codebases.
- Strong knowledge of AI frameworks and AI attack vectors, including prompt injection, agent manipulation, and workflow exploitation.
- Ability to establish and drive complex, cross-functional remediation initiatives.
- Excellent written communication and ability to explain complex topics clearly.
- Ability to translate technical findings into risk assessments and remediation recommendations.
- Strong analytical, problem-solving, and creative attack-scenario development skills.

## Nice to Have
- Published security research or conference presentations.
- Software engineering background with distributed-systems expertise.
- Experience with GitLab or similar DevSecOps platforms.

## Compensation and Benefits
- United States base salary: $203,200–$275,000 USD.
- Base salary excludes bonuses, equity, and benefits.
- Benefits include flexible paid time off, team member resource groups, equity compensation and employee stock purchase plan, growth and development funding, and parental leave.

## Similar jobs

- [Principal Security Awareness & Human Risk Engineer](https://hotfix.jobs/jobs/78ef4cbc-f12c-4557-b84e-ae3ad525db78) - GitLab - Remote - $203k – $275k/yr
- [GRC Principal - Data Privacy and Security](https://hotfix.jobs/jobs/38077c67-8197-4a7b-8873-908a51fba716) - Wrapbook - Remote - $143k – $232k/yr
- [Staff Security Engineer, Cloud and Product Security](https://hotfix.jobs/jobs/6f63ec23-4c3f-4815-b236-397f5ba0189d) - Lob - Remote - $198k – $220k/yr
- [Staff Application Security Engineer](https://hotfix.jobs/jobs/7ac2e48a-851e-4e49-8cb6-83a44f82862c) - Upside - Remote - $210k – $230k/yr
- [Staff Engineer - Container Security](https://hotfix.jobs/jobs/935b4780-2b70-443a-b457-18e396232e5a) - Illumio - Sunnyvale, CA - $194k – $233k/yr

**Apply:** https://hotfix.jobs/jobs/1ceb0cbb-1f4e-4652-8d72-4e04a6b901ef
**Canonical:** https://hotfix.jobs/jobs/1ceb0cbb-1f4e-4652-8d72-4e04a6b901ef