Senior Threat Intelligence Engineer

GitLab is looking for a seasoned Threat Intelligence Engineer to join as a dedicated Senior Security Engineer, TI. The program has a solid foundation already in place: reporting templates, tooling, feeds, and industry connections built out by the Security Operations team. Your mission is to provide actionable intelligence that empowers GitLab to make informed, proactive security decisions, getting in front of threats before they materialize. You will monitor GitLab's unique threat landscape with a focus on credible threats to GitLab and the software supply chain, using Python as a force multiplier through automation and AI, as the sole dedicated member of the team supported by Security Operations engineers.

Responsibilities

• Monitor the threat landscape, identifying and analyzing the risks most relevant to GitLab and raising awareness through ad-hoc Flash Reports.
• Administer the Threat Intelligence Platform and continue building out the open source, proprietary, and internal intelligence collection pipeline.
• Support incident response through malware analysis and threat actor tracking.
• Collaborate on Purple Team Flash Operations, turning emerging threats into collaborative exercises that validate and improve defensive capabilities.
• Build meaningful relationships with industry peers, sharing intelligence and collaborating on emerging threats.
• Write code, leverage AI, and build automation to improve process efficiencies on the team.

Qualifications

• Proven track record of delivering actionable intelligence that has had a meaningful impact on the security of an organization.
• Experience working with a Threat Intelligence Platform and managing ingested and exported threat feeds.
• Experience researching adversaries using OSINT and structured analytical techniques.
• Ability to automate tasks by writing scripts and programs, preferably with Python.
• Excellent written and verbal communication skills, articulating complex topics clearly and concisely.
• Valuable but optional: experience reverse engineering malware, particularly macOS and Linux malware and malware delivered via code repositories.
• Valuable but optional: public examples of blogs or open-source work related to threat intelligence.