Staff Software Engineer, Security Platform: Authentication - GitLab

GitLab is the intelligent orchestration platform for DevSecOps, enabling organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation.

Overview of the Role

As a Staff Software Engineer on GitLab's Authentication team, you will serve as the technical lead for how every user, application, token, and automated agent proves identity across GitLab.com, Self-Managed, and Dedicated environments.

GitLab acts as an OAuth 2.0 and OpenID Connect (OIDC) provider for millions of users, alongside accepting identity from enterprise providers via SAML and LDAP. You will help migrate multiple legacy token types and session methods from the Ruby on Rails monolith onto GATE—GitLab's authentication and authorization platform featuring an edge Secure Token Service written in Go.

Key Projects

• OAuth across Cells: Making OAuth clients, grants, and tokens operate seamlessly across cells.
• Global identities: Enabling unified user identities that work across organizations and cells.
• Token consolidation: Reducing token types and decoupling token issuance and validation from the monolith.
• Identity for AI agents and workloads: OAuth for Model Context Protocol (MCP) clients, workload identity federation, and scoped service identities.

What You'll Do

• Own the technical direction for authentication protocols at GitLab (OAuth 2.0, OIDC, SAML, token exchange) across the Rails monolith and GATE services.
• Author and drive design documents and architecture decision records (ADRs) for multi-quarter initiatives, breaking work into incremental deliverables behind feature flags.
• Lead backward-compatible migrations for token formats, client/grant states, and sessions without customer disruption.
• Maintain hands-on involvement with complex Ruby on Rails and Go codebases while reviewing architecture designs and merge requests.
• Define and maintain interface contracts with GATE Core, GATE Infra, Authorization, and Tenant Scale teams.
• Treat authentication as a security and availability boundary by conducting threat modeling, implementing rate limits and abuse controls, and leading incident responses.
• Mentor senior and intermediate engineers and foster protocol and security expertise across the team.
• Collaborate asynchronously with distributed team members across India, Europe, and the Americas, primarily making decisions in writing.
• Participate in on-call or operational rotations as required by the team's ownership model.

What You'll Bring

• Proven experience building and operating production identity or authentication systems at scale, with cross-functional technical leadership.
• Deep practical knowledge of OAuth 2.0 and OIDC (PKCE, refresh token rotation, token exchange, client registration, scopes, and JWTs with signing key rotations).
• Hands-on familiarity with SAML 2.0 SSO and enterprise identity integrations (LDAP, SCIM, or similar).
• Strong production proficiency in Ruby on Rails or Go (with willingness to work in both), including safe refactoring, feature flagging, and backward-compatible data migrations.
• A security-first mindset focused on token theft, replay attacks, revocation, and blast radius reduction.
• Experience with high-throughput multi-tenant SaaS environments and strict data isolation.
• Excellent written English communication suited for an all-remote, asynchronous organization.

Nice to Have

• Experience with authentication libraries (Doorkeeper, Devise, OmniAuth), passkeys, MFA, workload identity, or AI agent authentication.
• Contributions to identity standards or open-source identity projects.

Benefits

• Comprehensive health, financial, and well-being coverage
• Flexible Paid Time Off (PTO)
• Equity compensation and Employee Stock Purchase Plan (ESPP)
• Growth and Development Fund
• Parental leave
• Team Member Resource Groups