Principal Security Engineer, Application Security

An overview of this role

The Application Security + Response (ASR) subdepartment works with GitLab engineers and product teams to anticipate and prevent the introduction of vulnerabilities during design and development, ensuring delivery of high quality software GitLab customers can trust. We also identify, assess, and respond to security vulnerabilities discovered in GitLab products and services that are reported through Coordinated Vulnerability Disclosure practices.

The Principal Application Security Engineer reports to the Senior Director of Application Security + Response and drives complex, strategic security engineering solutions. 

What you'll do

• Drive the resolution of systemic vulnerability classes and mitigations across the GitLab platform and perform difficult and highly complex application security reviews and threat modeling.
• Perform vulnerability research by exploring the full impact of security issues, demonstrating proof-of-concept exploitation in a controlled environment.
• Demonstrate technical security leadership, defining and establishing secure development practices, Paved Roads and security standards that will support Product and Engineering teams to deliver secured features at a high velocity.
• Provide technical leadership in security crisis situations and major incident response
• Contribute to long-term security architecture and strategic product design through technical expertise

What you’ll bring: 

• Ability to use GitLab effectively
• Bachelor's degree or equivalent in Computer Science or equivalent practical education (including technical bootcamp training programs) and experience.
• 8+ years professional experience in Application Security or Vulnerability Research
• Expert level understanding of computer code and how to detect and remediate classes of security defects, race condition based logic vulnerabilities etc
• Programming experience in one or more coding languages, with a preference for Ruby, Ruby on Rails, Go, TypeScript languages and being familiar with GraphQL APIs. Professional developer code quality is not required but being able to build code and understand it for developing PoC exploits and performing security review or fix validation work is a requirement.
• Expert level knowledge of application security concepts such as OWASP Top 10 bug types, the STRIDE model, CVSS scoring, and Threat Modeling assessments