Staff Backend Engineer, Software Supply Chain Security

Responsibilities

• Define and drive the technical architecture for the Software Supply Chain Security Add-On, including backend systems for package policy enforcement, provenance generation, artifact signing, and malicious package detection.
• Lead design and implementation of Supply-chain Levels for Software Artifacts (SLSA) Level 2 and Level 3 capabilities within GitLab CI/CD.
• Architect integrations with Sigstore services such as Cosign, Fulcio, and Rekor, including signing workflows, verification, and trust boundaries.
• Design backend services and request paths supporting allow, deny, and quarantine package policies with strong performance and reliability.
• Review merge requests for security, architectural consistency, maintainability, and test quality.
• Mentor Backend Engineers across experience levels through design guidance, feedback, and hiring participation.
• Partner with Product, Infrastructure, Authentication, Authorization, and Security teams on cross-team technical decisions.
• Contribute to relevant open-source and industry discussions, including software supply chain security working groups where appropriate.

Requirements

• Strong experience building backend applications with Ruby on Rails in a high-scale production environment.
• Professional experience with Go for backend or infrastructure-oriented services.
• Track record of leading architecture across multiple systems and influencing technical direction through sound engineering judgment.
• Experience writing technical proposals, request-for-comments documents, and decision records in an asynchronous, documentation-first environment.
• Strong security mindset and comfort building products where trust, risk reduction, and secure defaults are central requirements.
• Familiarity with software supply chain security concepts such as build provenance, artifact signing, dependency security, or software bills of materials.
• Strong teamwork and communication skills, with the ability to work effectively across distributed teams and functions.
• Interest in GitLab's values and in building secure, scalable product capabilities.

Compensation and Benefits

• Flexible paid time off.
• Team member resource groups.
• Equity compensation and employee stock purchase plan.
• Growth and development fund.
• Parental leave.