Threat Research Engineer, Security Factory: Threat Research

• Join GitLab as a Threat Research Engineer, working fully remotely from the UK. • Take ideas from the first question to a working proof of concept, then deploy it and analyse the results yourself. • Work in a full-stack role where AI is central, building agentic workflows for research, analysis and detection. • Research emerging threats and turn what you learn into protection for GitLab customers. • Help maintain the GitLab Advisory Database, which powers GitLab's dependency scanning. • Publish original vulnerability research, with recent work including the Shai-Hulud npm worm and a critical remote code execution vulnerability in Serena.

• Bring hands-on security experience in research, malware analysis, penetration testing or security tooling, with both a developer and an adversarial mindset. • Show demonstrated experience using AI in real work, such as building with large language model APIs or agent frameworks like LangChain, LangGraph or agent SDKs. • Use Go or Python with good engineering practices, including testing, code review, CI/CD and maintainable code. • Show experience deploying and running production services on a public cloud. • Know how package ecosystems work and how software supply chain attacks happen. • Map possible attack vectors, name trade-offs and make data-driven decisions with customer outcomes in mind. • Write clearly to explain findings to both engineers and a general audience.

• Share published vulnerability findings. • Bring security research experience on AI agents, large language model applications or Model Context Protocol (MCP) servers. • Use Google Cloud Platform. • Use infrastructure as code tools such as Terraform or OpenTofu. • Keep up with security and AI industry trends.

• Research new attack surfaces and threat vectors, including AI coding agents, agent plugins and package ecosystems. • Find and responsibly disclose vulnerabilities in open source projects and developer tools. • Analyse software supply chain incidents and events. • Build AI-powered workflows and agents that automate research, analysis and detection. • Build and maintain the cloud-based systems behind detection and advisory work. • Improve the quality and coverage of vulnerability and malware advisories. • Write up findings as blog posts and present them at conferences. • Take part in on-call or operational support where your team's ownership model requires it.

• Work fully remotely from the UK. • Take flexible paid time off. • Receive equity compensation and join the Employee Stock Purchase Plan. • Use the Growth and Development Fund to build your skills. • Benefit from parental leave and health, finance and wellbeing benefits. • Join Team Member Resource Groups.

GitLab is the intelligent orchestration platform for DevSecOps, helping organisations improve developer productivity, reduce security and compliance risk, and ship secure software faster. It has more than 50 million registered users and is trusted by more than 50% of the Fortune 100. The Threat Research group researches emerging security threats, maintains the GitLab Advisory Database and publishes its findings on the Security Labs blog.