Staff Software Engineer, Security Foundations

As a Staff Software Engineer, you'll help lead two important areas for GitLab Security: the data layer behind our vulnerability and dependency management capabilities, and our move toward services outside the GitLab monolith. You'll design and develop systems that ingest, store, index, and query security report data, including integrations with key third-party systems. With a strong focus on PostgreSQL and scalable backend design, your work will support security features delivered by teams across GitLab.

You'll take ownership of large deliverables from early ideas through implementation, working directly with product, design, frontend, and engineering partners to shape the technical and product roadmap. You'll stay hands-on across GitLab's Ruby on Rails application and newer services, including greenfield projects, while helping the team build its expertise in modular service design.

What you’ll do

• Lead large technical deliverables from initial problem definition through delivery, often across multiple months or quarters.
• Design and develop backend systems for vulnerability and dependency management, including security report ingestion, storage, indexing, querying, and integrations with key third-party systems.
• Build and improve systems using Ruby on Rails and PostgreSQL, and contribute to newer services using technologies such as Go or Rust where appropriate.
• Shape technical plans, break down complex work, and help other engineers deliver effectively.
• Work directly with product, design, frontend, and engineering partners to make clear decisions, resolve constraints, and deliver measurable progress.
• Influence the team's product and technical roadmap through hands-on investigation, clear proposals, and iterative delivery that demonstrates progress in each monthly release cycle.
• Apply a security mindset when designing systems, including considering how GitLab identifies and handles malicious or vulnerable software packages.
• Define patterns for modular services, provide technical leadership when vulnerability management work spans multiple GitLab areas, and share that expertise across GitLab Security.

What you’ll bring

• Experience leading complex backend projects from idea through delivery while remaining hands-on with design and development.
• Strong PostgreSQL experience, including evidence of query optimization, table optimization, and write-ahead log management in data-intensive systems.
• Strong professional experience with Ruby on Rails or  Go and comfort working in Ruby on Rails day to day. Experience with large monoliths is helpful, along with an interest in working across languages and services.
• Experience shaping delivery plans, guiding technical decisions, and supporting the work of other engineers.
• The ability to collaborate with a range of partners and explain technical trade-offs clearly.
• Experience communicating with leaders, leading peers through complex delivery, identifying constraints, and moving work forward.
• Experience using security tooling for activities such as vulnerability triage and remediation, or professional experience building vulnerability management, dependency management, or related security products.
• Experience with large-scale data systems or established software products. We welcome transferable experience from outside the security domain.
• Fluency in using artificial intelligence tools to improve delivery while applying sound engineering judgment.

About the team

The Vulnerability Management team contributes to GitLab's move toward modular services and will help other Security teams adopt these patterns over time. Today, we include two Staff Software Engineers, two Senior Software Engineers, and one Intermediate Software Engineer across the United Kingdom, Poland, the Netherlands, and India. You'll work closely with us, product partners, and engineering leaders across GitLab.

We work with clear goals and shared priorities. You'll receive clear context and outcomes, then have the space to own delivery, communicate decisions and progress, ask for help early, and work directly with the partners needed to get the job done.