Drimva

GitLab

Staff Software Engineer, Security Factory: Static Analysis

$153K–$259K

Remote, Canada +7 · Remote · Staff · Full-time · Posted Oct 9, 2026

Location
Remote, Canada
Remote, Israel
Remote, United Kingdom
Remote, United States
Canada
Israel
United Kingdom
United States of America

About the job

Set technical direction and own architecture for GitLab’s static analysis engine and evaluation tooling, using AI agents and engineers to build and validate security findings.

What you'll do

  • Lead high-scope initiatives from design through delivery, and define the engine’s architecture, specifications, and long-range technical goals.
  • Build and maintain program analysis and evaluation systems, including benchmark testing and safeguards for AI-generated code and results.
  • Mentor engineers, improve team standards, collaborate across teams, and participate in on-call rotations.

What they ask for

  • Experience building LLM tooling such as a harness, agent pipeline, or evaluations.
  • Extensive professional experience writing, testing, and reviewing production code in Rust, Go, or a comparable systems language, with depth in at least one.
  • Deep program analysis/static analysis and application security experience, including vulnerability classes such as OWASP Top 10 and CWE.
  • Experience with performance optimization, containerized workflows, and CI/CD; demonstrated ownership, architecture, communication, and mentoring abilities.

Nice to have

  • Familiarity with popular web or mobile application frameworks.
  • Experience designing guardrails for agent-written code, or research-community engagement through publications, tool papers, or open-source contributions.

Pay

$152,800 — $259,200 USD (base salary)

Tools

Rust, Go, Ruby, Docker, LLM, SAST, CWE, OWASP

AI focus

Direct AI agents that implement and review code from specifications; build agent harnesses, instructions, skills, and independent safeguards to validate changes and findings.

Model-written summary · the original posting is authoritative

First seen Oct 10, 2026 · Last verified Nov 4, 2026 (UTC)