Threat Research Engineer, Security Factory: Threat Research - GitLab

GitLab is the intelligent orchestration platform for DevSecOps, enabling organizations to increase developer productivity, improve operational efficiency, and reduce security and compliance risk.

Overview

As a Threat Research Engineer, you will take ideas from the first question to a working proof of concept, deploy it, and analyze the results yourself. This is a full-stack role with AI central to how the team works. You will build agentic workflows for research, analysis, and detection, and use AI tools daily to move faster.

What You'll Do

• Research new attack surfaces and threat vectors, including AI coding agents, agent plugins, and package ecosystems.
• Find and responsibly disclose vulnerabilities in open source projects and developer tools.
• Analyze software supply chain incidents and events.
• Build AI-powered workflows and agents that automate research, analysis, and detection.
• Build and maintain the cloud-based systems behind detection and advisory work.
• Improve the quality and coverage of vulnerability and malware advisories.
• Write up findings as blog posts and present them at industry conferences.
• Participate in on-call or operational support as required by the team's ownership model.

What You'll Bring

• Hands-on security experience in research, malware analysis, penetration testing, or security tooling, combining both developer and adversarial mindsets.
• Demonstrated experience utilizing AI in practical workflows, such as building with LLM APIs or agent frameworks (e.g., LangChain, LangGraph, or agent SDKs).
• Strong programming skills in Go or Python, backed by solid software engineering practices (testing, code review, CI/CD, maintainable code).
• Experience deploying and running production services on a public cloud.
• Understanding of package ecosystems and software supply chain attack mechanisms.
• Ability to map attack vectors, evaluate trade-offs, and make data-driven decisions that balance speed and quality.
• Clear communication and writing skills to explain technical findings to both engineers and general audiences.

Bonus Qualifications

• Published vulnerability findings.
• Prior security research on AI agents, LLM applications, or Model Context Protocol (MCP) servers.
• Experience with Google Cloud Platform (GCP).
• Infrastructure as Code experience using Terraform or OpenTofu.

About the Team

The Threat Research group researches security threats as they emerge and turns findings into protections for GitLab customers. The team maintains the GitLab Advisory Database powering dependency scanning, builds detection capabilities, performs original vulnerability research, and publishes findings on the GitLab Security Labs blog.