Staff Software Engineer, Security Factory: Static Analysis

Overview

In this role you guide the long-range technical direction of GitLab’s static analysis engine within the Security Factory: Code Scanning team. You own architecture and select AI-assisted tooling to ensure trustworthy findings, shaping security analysis across languages and frameworks. You collaborate with cross-functional partners to raise quality, security, and performance while mentoring engineers and driving high-impact features from design to production. You will work at scale to improve developers’ ability to find and fix security issues, contributing to GitLab’s mission of secure, efficient software delivery.

Pay / Benefits

• Flexible Paid Time Off
• Team Member Resource Groups
• Equity Compensation & Employee Stock Purchase Plan
• Growth and Development Fund
• Parental Leave

Responsibilities

• Act as the directly responsible individual (DRI) for high-scope initiatives from design to delivery, shipping large features with minimal guidance
• Transfer ownership of engine components to the team through documentation, tests, and shared reviews
• Set the technical direction for AI-assisted tooling and implement checks ensuring agent-written changes are trustworthy
• Own architecture of the program model (parsing, symbol resolution, IRs, call graphs, taint/data-flow) and the data pipeline turning code into findings
• Define architecture and specifications; delegate components to engineers and AI agents
• Build and maintain harnesses and agent instructions to keep agent-written code trustworthy, including safety gates and independent reviews
• Mentor engineers through code reviews and pairing; remove blockers to autonomy; uphold internal standards
• Participate in on-call rotations for troubleshooting product and security issues
• Define overarching architecture and specifications for engine components and drive implementations via phased plans
• Stay current with research in program analysis and security; turn findings into prototypes and upstream contributions
• Collaborate with PM, UX, Code Security, and other teams to advocate quality, security, and performance

Key requirements

• Experience building your own LLM tooling (harness, agent pipeline, evaluations) with judgment on output trustworthiness
• Production code in Rust, Go, or comparable systems language; depth in at least one
• Performance optimization and containerized workflows/CI-CD (Docker)
• Strong background in program analysis/static analysis (parsing, ASTs, IRs, taint/data-flow)
• Deep application security experience; familiarity with OWASP Top 10 and CWE
• Clear, concise communication; ability to write architecture/design specifications
• History of owning ambiguous, cross-team problems and delivering production-ready solutions
• Experience defining system architecture and delegating specs to engineers and AI agents
• Mentoring engineers; raising technical bar; influencing direction through consensus
• Experience with designing guardrails for AI-generated code (mutation testing, fuzzing, CI gates)

• strong communication
• ownership mindset
• collaboration with cross-functional teams
• LLM tooling and AI-assisted development
• Rust and/or Go development
• static program analysis (parsing, SSA, CFG, call graphs, taint analysis)

Full job description from WhatJobs. Apply for this role →