Description
GitLab is seeking a Threat Research Engineer to research emerging security threats and develop protections for its customers.
As a Threat Research Engineer at GitLab, you'll research new attack surfaces, including AI coding agents, agent plugins, and package ecosystems, and build systems to detect threats and improve vulnerability advisories.
Responsibilities:
- Research new attack surfaces and threat vectors
- Find and responsibly disclose vulnerabilities in open-source projects and developer tools
- Analyze software supply chain incidents and events
- Build AI-powered workflows and agents for research, analysis, and detection
- Develop and maintain cloud-based systems for detection and advisory work
- Improve vulnerability and malware advisories
- Write blog posts and present findings at conferences
Requirements:
- Hands-on security experience in research, malware analysis, penetration testing, or security tooling
- Developer mindset and adversarial mindset
- Experience using AI in real work
- Strong programming skills in Go or Python
- Experience deploying and running production services on a public cloud
- Ability to map attack vectors, explain trade-offs, and use data to drive experiments
- Clear writing for engineers and general audiences
Nice to Have:
- Google Cloud Platform (GCP)
- Common Vulnerabilities and Exposures (CVE) entries or published findings
- Research on AI agents, LLM applications, or Model Context Protocol (MCP) servers
- Blogs, talks, or open-source security tools
- Terraform or OpenTofu
- Databases or data pipelines at scale
- Reverse engineering
Benefits:
- Health, finance, and well-being support
- Flexible Paid Time Off
- Team Member Resource Groups
- Equity Compensation & Employee Stock Purchase Plan
- Growth and Development Fund
- Parental Leave