Senior Software Security Engineer

As a Senior Software Security Engineer on GitLab's Trust and Safety team, you will engineer security improvements to the GitLab product and build and maintain the tools used to detect and prevent abuse on GitLab's SaaS platforms. You will predictively identify abuse patterns and trends and build anomaly detection and prevention systems to mitigate abusive users and their activities. A strong software engineering background with experience in large Ruby/Rails codebases is required; formal security engineering experience is not, making this an ideal fit for engineers interested in moving into security.

Responsibilities

• Maintain core abuse prevention systems and build new abuse detection rules to identify and prevent evolving platform abuse such as spam, AI/token abuse, SEO redirects, and other financially motivated campaigns.
• Become a core maintainer of the in-house abuse platform, a Ruby on Rails monolith, supporting and building new features for it.
• Improve and expand agentic AI capabilities in abuse mitigation tools, including multi-agent reasoning decision patterns that reduce human-in-the-loop operational load.
• Lead collaboration with peer engineering teams to deliver safety improvements for the GitLab product.
• Resolve automation gaps and create efficient, automated processes.
• Create and maintain documentation such as runbooks and procedures.

Qualifications

• Strong software development skills with experience in Ruby/Rails.
• Experience working on distributed applications with large codebases deployed in cloud environments, strongly preferred.
• Passion for proactively developing security engineering skills.
• Strong experience with cloud native development on GCP and/or AWS.
• Interest in thinking like a hacker and defending against attacks with an automation-first mindset.
• Interest in handling trust and safety security incidents and collaborating with engineering to harden platform defenses.
• Experience on an AI native development team, maintaining teams of agents and acting as a code reviewer, abstracting your role away from writing most code by hand.
• Comfort working in an all-remote environment where results and impact matter above hours worked.