Greenhouse ·
full-timePrincipal Security Researcher
Gitlab · Remote, Canada; Remote, Israel; Remote, United Kingdom; Remote, United States
GitLab provides an intelligent orchestration platform for DevSecOps, helping organizations boost developer productivity, improve operational efficiency, and reduce security and compliance risk while accelerating digital transformation. The Principal Security Researcher will join the Application Security Team to lead cutting‑edge security research on GitLab’s AI‑powered DevSecOps capabilities. Day‑to‑day activities include conducting and directing security research projects, identifying novel and chained vulnerabilities across the platform, validating findings through hands‑on penetration testing and proof‑of‑concept exploits, and assessing emerging vulnerability classes against the codebase. The role also focuses on researching the security posture of AI agents, Duo Chat, and related workflows, building tooling and automation for scalable vulnerability discovery, and collaborating with engineering teams to translate threats into security improvements. Additionally, the researcher will evaluate open‑source dependencies integrated with GitLab, report findings to maintainers, and follow responsible disclosure guidelines. This position suits experienced security professionals with deep expertise in application security, penetration testing, vulnerability research, and a strong interest in AI and agent‑based systems, who can work independently and drive remediation efforts across a large, distributed codebase.
GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50 million registered users and more than 50% of the Fortune 100* trust GitLab to ship better, more secure software faster. The same principles built into our products are reflected in how our team works: we embrace AI as a core productivity multiplier, with all team members expected to incorporate AI into their daily workflows to drive efficiency, innovation, and impact. GitLab is where careers accelerate, innovation flourishes, and every voice is valued. Our high-performance culture is driven by our values and continuous knowledge exchange, enabling our team members to reach their full potential while collaborating with industry leaders to solve complex problems. Co-create the future with us as we build technology that transforms how the world develops software. * Fortune 500® is a registered trademark of Fortune Media IP Limited, used under license. Claim based on GitLab data. Fortune 100 refers to the top 20% ranked companies in the 2025 Fortune 500 list, published in June 2025. Fortune and Fortune Media IP Limited are not affiliated with, and do not endorse products or services of GitLab. An overview of the role We are seeking a Principal Security Researcher to join our Application Security Team to conduct cutting-edge security research on GitLab's AI-powered DevSecOps capabilities. As GitLab transforms software development through intelligent collaboration between developers and specialized AI agents, we need security researchers who can proactively identify and validate vulnerabilities before they impact our platform or customers. In this role, you'll be at the forefront of security research, working with our GitLab DevSecOps platform, Duo Agent Platform, GitLab Duo Chat, and AI workflows that represent the future of human/AI collaborative development. You'll develop novel testing methodologies (including for AI agent security), conduct hands-on penetration testing, and translate emerging threats into actionable security improvements. Your research will directly influence how we build and secure the next generation of AI-powered DevSecOps tools, ensuring GitLab remains the most secure software factory platform on the market. This position offers the unique opportunity to shape security and AI security practices in one of the world's largest DevSecOps platforms, working with engineering teams who are pushing the boundaries of what's possible with AI-assisted software development. You'll have access to cutting-edge AI systems and the freedom to explore creative attack scenarios while contributing to the security of millions of developers worldwide. This role reports to the Senior Manager of Application Security. What you'll do Conduct and lead security research projects across multiple functional areas. Identify novel, systemic, and chained vulnerabilities in GitLab, where individual weaknesses combine for outsized impact. Validate security vulnerabilities through hands-on testing, developing proof-of-concept exploits that demonstrate real-world attack scenarios. Assess emerging industry vulnerability classes against the GitLab codebase, and drive remediation of the class rather than the instance. Lead security research into GitLab's AI and agentic surfaces, and define the security requirements that engineering teams build against. Build and direct the tooling and automation that scales security research, including agent-assisted vulnerability discovery across our codebase. Research the security posture of open source tools and dependencies integrated with GitLab, report findings to their maintainers, and track mitigation following our responsible disclosure guidelines . Solve technical problems of the highest scope, complexity, and ambiguity. Help shape the team and sub-department roadmap. Lead the integration of security research results into the engineering and business functions that need to act on them. Teach, mentor, and advise other domain experts and individual contributors across several teams. Share knowledge and novel vulnerability types with the security community. What you'll bring 10+ years of experience in security research, penetration testing, or offensive security roles Strong ability in discovering and exploiting vulnerabilities in large codebase and complex systems Proficiency in two or more of Ruby, Go, Python, TypeScript, or Rust. Ability to read and analyze code across multiple languages and codebases Strong knowledge of AI frameworks Strong understanding of AI attack vectors including prompt injection, agent manipulation, and workflow exploitation At ease in establishing and driving complex remediation initiatives involving cross-functional teams Excellent written communication skills with an ability to articulate complex topics in a cl
| Role | Principal Security Researcher |
|---|---|
| Company | Gitlab |
| Location | Remote, Canada; Remote, Israel; Remote, United Kingdom; Remote, United States |
| Compensation | Not disclosed |
| Posted | 2026-09-29 |
| Deadline | Rolling |
Typical process for this type of role
A general guide — the exact steps for this specific listing may vary; check the original posting for details.
- 1ApplicationSubmit your resume through the apply link.
- 2ScreeningRecruiter reviews your background against the role.
- 3AssessmentA technical test, assignment, or coding round, depending on the role.
- 4Interview(s)One or more rounds with the hiring team.
- 5OfferOffer letter with compensation and start date.
Before you apply
0/4Principal Security Researcher at Gitlab: frequently asked questions
- What is the salary for this role?
- Gitlab has not stated compensation in the listing. Check the original posting or ask during the application process.
- Is the Principal Security Researcher position remote, hybrid or onsite?
- The listing marks this role as remote, with Remote, Canada; Remote, Israel; Remote, United Kingdom; Remote, United States as the location.
- What is the application deadline?
- Gitlab has not listed a fixed deadline, so apply early in case the opening is filled.
- How do I apply for the Principal Security Researcher role?
- Use the Apply button on this page. It opens the original listing on job-boards.greenhouse.io, where you submit your application with the company.
More at Gitlab
Other jobs at Gitlab
- Engineering Manager, Dedicated Infrastructure · Remote, Canada; Remote, United States
- Manager, Assigned Support Engineering (emea) · Remote, United Kingdom
- Support Engineer, U.S. Government Support · Remote, United States
- Senior Product Manager, CRM & GTM Systems · Remote, United States
- Major Account Executive · Remote, Germany
Explore Related Placements
// similar opportunities
You might also like
Principal Threat Researcher
Zscaler
Zscaler (NASDAQ: ZS) accelerates digital transformation so customers can be more agile, efficient, resilient, and secure. The Zscaler Zero Trust Exchange™️ plat...
Staff / Principal Applied AI Researcher (agentic Search)
Nebius
About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports develo...
Senior AI Security Research Engineer
Samsara
Who we are Samsara (NYSE: IOT) is the pioneer of the Connected Operations™ Cloud, which is a platform that enables organizations that depend on physical operati...
Staff Threat Researcher
Zscaler
Zscaler (NASDAQ: ZS) accelerates digital transformation so customers can be more agile, efficient, resilient, and secure. The Zscaler Zero Trust Exchange™️ plat...
Principal Presales Engineer
Twilio
Who we are At Twilio, we’re shaping the future of communications, all from the comfort of our homes. We deliver innovative solutions to hundreds of thousands of...
Principal Product Manager
Twilio
Who we are At Twilio, we’re shaping the future of communications, all from the comfort of our homes. We deliver innovative solutions to hundreds of thousands of...