Intermediate Backend Engineer, Authorization - GitLab

GitLab is the intelligent orchestration platform for DevSecOps, trusted by more than 50 million registered users and over 50% of the Fortune 100 to ship better, more secure software faster.

An Overview of This Role

As a Software Engineer on GitLab's Authorization team, you'll help build and maintain the system that decides what every user, token, and automated agent can access on GitLab.com, Self-Managed, and Dedicated. You'll work alongside experienced engineers who guide larger design decisions, delivering well-scoped changes and growing into ownership of larger parts of the system.

Today, that work is built on Ruby on Rails. Roughly 400 policy classes and a catalog of about 1,900 permissions sit behind every API request. You'll work on fine-grained token permissions, custom roles, and the GraphQL and REST APIs that enforce them.

You'll also contribute to moving the permission model to a new authorization stack that pairs the Rails monolith with a Rust policy engine. Prior Rust experience is not required—several engineers on the team learned it for this work, and support will be provided.

What You'll Do

• Implement authorization changes in GitLab's Ruby on Rails monolith so permission checks allow intended access and deny unauthorized access.
• Deliver well-scoped workstreams from feature-flagged rollout through verifying that old and new systems produce the same results, with review and guidance from senior engineers.
• Build and extend fine-grained permissions for tokens and roles.
• Extend and fix authorization enforcement so GraphQL and the REST API enforce intended permissions consistently.
• Make incremental refactors to long-lived policy code without changing behavior for existing customers.
• Investigate and fix reliability, performance, and security issues.
• Work with authentication, platform, and AI teams to document interface contracts for the shared authorization service.
• Contribute to design documents, merge requests, and code reviews asynchronously.

What You'll Bring

• Solid experience building and maintaining production Ruby on Rails applications (typically 2 to 4 years or more).
• Hands-on experience with authorization concepts, such as role-based access control or fine-grained permissions.
• A security mindset: treating permission bugs as security bugs.
• Experience making careful changes to existing codebases, including incremental refactors and feature-flagged rollouts.
• Familiarity with GraphQL or API authorization patterns.
• Strong written communication skills and the ability to work effectively in an asynchronous, documentation-first environment.
• Helpful, but not required: PostgreSQL, Rust, gRPC, Protocol Buffers, Cedar or other policy languages, Zanzibar-style systems, Go, or service-oriented architecture.