Staff Security Researcher - GitLab

About the Role

GitLab is seeking a Staff Security Research Engineer to join our Application Security Team. You will conduct cutting-edge security research on GitLab's AI-powered DevSecOps capabilities, including the Duo Agent Platform and AI workflows. You will be responsible for identifying systemic vulnerabilities, developing novel testing methodologies, and ensuring the security of the next generation of AI-assisted software development tools.

What You'll Do

• Security Research: Conduct research in two or more specialty areas and identify systemic, chained vulnerabilities.
• Vulnerability Validation: Perform hands-on penetration testing and develop proof-of-concept exploits.
• AI Security: Research security posture for AI and agentic surfaces, including prompt injection and agent manipulation.
• Tooling & Automation: Build scalable security research tools and agent-assisted vulnerability discovery systems.
• Collaboration: Define security requirements, mentor team members, and provide actionable feedback to engineering teams.
• Responsible Disclosure: Research open-source dependencies and coordinate findings with maintainers.

What You'll Bring

• 7+ years of experience in security research, penetration testing, or offensive security.
• Proficiency in Ruby, Go, Python, TypeScript, or Rust.
• Deep understanding of AI attack vectors (prompt injection, agent manipulation).
• Ability to analyze code across multiple languages and complex codebases.
• Experience leading technical objectives in cross-functional environments.
• Excellent written communication skills for risk assessment and remediation reporting.

Why GitLab?

• Work on a high-performance, remote-first team.
• Access to cutting-edge AI systems and the freedom to explore creative attack scenarios.
• Comprehensive benefits including flexible PTO, parental leave, and equity compensation.