Staff Software Engineer, Security Factory: Static Analysis

What you do:

• Own the architecture of the program model, including parsing, symbol resolution, intermediate representations, call graphs, and taint analysis, and define how it extends to new languages.
• Build and maintain the harness and agent instructions that keep agent-written code trustworthy, with separate coding and reviewing agents and independent review panels.
• Stay current with research in program analysis and security, run AI-assisted research, and turn findings into prototypes and upstream contributions.

What you bring:

• Extensive professional experience writing, testing, and reviewing production code in Rust, Go, or a comparable systems language.
• Deep program analysis background with expertise in parsing, ASTs, SSA, data-flow analysis, type inference, or detection rules.
• Demonstrated capacity to communicate clearly about complex technical and architectural problems and write specifications that bring a team to a decision.

About the team:

• The Security Factory: Code Scanning team develops GitLab's SAST capabilities for customer software repositories.
• We work closely with Code Security on scanning rules and flows, with Composition Analysis on the software supply chain, and rely heavily on asynchronous work across time zones.