Staff Security Researcher

Responsibilities

• Conduct security research across at least two specialty areas.
• Identify novel, systemic, and chained vulnerabilities in GitLab.
• Validate vulnerabilities through hands-on testing and proof-of-concept exploits.
• Assess emerging vulnerability classes against the GitLab codebase and drive class-level remediation.
• Research security risks in GitLab’s AI and agentic surfaces and help define security requirements.
• Build tooling and automation for scalable security research, including agent-assisted vulnerability discovery.
• Research the security posture of open-source tools and dependencies, report findings to maintainers, and track mitigation.
• Solve high-scope, complex, and ambiguous technical problems.
• Define and implement security and process improvements.
• Contribute to the team roadmap and provide actionable feedback to engineering teams.
• Mentor and advise individual contributors.
• Share knowledge and novel vulnerability types with the security community.

Requirements

• 7+ years of experience in security research, penetration testing, or offensive security.
• Hands-on experience discovering and exploiting vulnerabilities.
• Subject matter expertise in at least two technical areas affecting product security.
• Proficiency in one or more of Ruby, Go, Python, TypeScript, or Rust.
• Ability to read and analyze code across multiple languages and codebases.
• Understanding of AI attack vectors, including prompt injection, agent manipulation, and workflow exploitation.
• Experience leading technical objectives in cross-functional teams.
• Excellent written communication and ability to explain complex topics clearly.
• Ability to translate technical findings into risk assessments and remediation recommendations.
• Strong analytical, problem-solving, and creative attack-scenario skills.

Nice to Have

• Published security research or conference presentations.
• Software engineering background with distributed-systems expertise.
• Security certifications such as OSCP, OSCE, or GPEN.
• Experience with GitLab or similar DevSecOps platforms.
• Experience with AI frameworks.

Compensation and Benefits

• United States base salary: $168,000–$238,000 USD.
• Benefits include flexible paid time off, team member resource groups, equity compensation and employee stock purchase plan, growth and development funding, and parental leave.