Staff Backend Engineer, Software Supply Chain Security - GitLab

About the Role

As a Staff Backend Engineer at GitLab, you will help shape a major investment in our Software Supply Chain Security (SSCS) offering. You will serve as a senior technical leader for backend systems that help customers secure how software is built, verified, and delivered. You will define architecture, write technical proposals, and guide implementation across CI/CD, dependency management, and security workflows.

What You’ll Do

• Technical Leadership: Define and drive the architecture for the SSCS Add-On, including package policy enforcement, provenance generation, and artifact signing.
• Security Engineering: Lead implementation of SLSA Level 2 and 3 capabilities and architect integrations with Sigstore services (Cosign, Fulcio, Rekor).
• System Design: Design backend services for package allow/deny/quarantine policies with high performance and reliability.
• Mentorship: Review merge requests, mentor engineers across levels, and raise the technical bar through design guidance.
• Collaboration: Partner with Product, Infrastructure, and Security teams to drive cross-team technical decisions.

What You’ll Bring

• Backend Expertise: Strong experience with Ruby on Rails in high-scale production environments.
• Systems Programming: Professional experience with Go for backend or infrastructure services.
• Architectural Vision: A track record of leading architecture across multiple systems and influencing technical direction.
• Communication: Ability to write clear technical proposals and decision records in an asynchronous, documentation-first environment.
• Security Mindset: Familiarity with supply chain security concepts (build provenance, artifact signing, SBOMs, dependency security).

About the Team

The SSCS Add-On team builds commercial offerings that address real-world supply chain security challenges for enterprise customers. We operate in a fast-moving space, allowing engineers to contribute to product direction while solving complex backend challenges.