Description
GitLab is seeking an Intermediate Backend Engineer for its Authorization team. As a Software Engineer on GitLab's Authorization team, you'll help build and maintain the system that decides what every user, token, and automated agent can access on GitLab.com, Self-Managed, and Dedicated.
You'll work alongside experienced engineers who guide the larger design decisions, delivering well-scoped changes and growing into ownership of larger parts of the system. Today, that work is Ruby on Rails. Roughly 400 policy classes and a catalog of about 1,900 permissions sit behind every application programming interface (API) request.
Your responsibilities will include:
- Implementing authorization changes in GitLab's Ruby on Rails monolith so permission checks allow intended access and deny unauthorized access.
- Delivering well-scoped workstreams from feature-flagged rollout through verifying that the old and new systems produce the same results, with review and guidance from senior engineers.
- Building and extending fine-grained permissions for tokens and roles so additional resources have permission coverage consistent with the established catalog.
- Extending and fixing authorization enforcement so GraphQL and the REST API enforce the intended permissions consistently.
- Making incremental refactors to long-lived policy code without changing behavior for existing customers.
- Investigating and fixing reliability, performance, and security issues so affected permission checks return the expected results without regressions.
- Working with the authentication, platform, and artificial intelligence (AI) teams to document interface contracts that keep permission checks consistent as authorization moves toward a shared service.
- Contributing to design documents, merge requests, and code reviews so proposed changes have a documented rationale and review feedback is addressed asynchronously.
To be successful in this role, you'll need:
- Solid experience building and maintaining production Ruby on Rails applications, typically gained over 2 to 4 years or more.
- Hands-on experience with authorization concepts, such as role-based access control or fine-grained permissions, from work or projects.
- A security mindset: you treat a permission bug as a security bug and consider who a change could affect before choosing an implementation.
- Experience making careful changes to existing codebases, including incremental refactors and feature-flagged rollouts that preserve existing behavior.
- Familiarity with GraphQL or API authorization patterns.
- Awareness of performance, including how repeated permission checks can add up on every request.
- Strong written communication and the ability to work effectively when most decisions happen in a document or merge request rather than a meeting.
GitLab offers various benefits, including:
- Benefits to support your health, finances, and well-being
- Flexible Paid Time Off
- Team Member Resource Groups
- Equity Compensation & Employee Stock Purchase Plan
- Growth and Development Fund
- Parental Leave