Threat Research Engineer

About the role

GitLab is hiring a Threat Research Engineer for its Threat Research group, remote from India (Bengaluru). The engineer will research new attack surfaces such as AI coding agents, agent plugins, and pa… Subscribe to Premium to view the full description and apply.

Responsibilities

• Research new attack surfaces and threat vectors, including AI coding agents, agent plugins, and package ecosystems.
• Find and responsibly disclose vulnerabilities in open source projects and developer tools.
• Analyse software supply chain incidents.
• Build AI-powered workflows and agents that automate research, analysis, and detection.
• Build and maintain the cloud systems behind detection and advisory work, and improve vulnerability and malware advisories.
• Publish findings as blog posts and conference talks.

Requirements

• Hands-on security experience in research, malware analysis, penetration testing, or security tooling, with knowledge of supply chain attacks.
• Both a developer mindset and an adversarial mindset.
• Experience using AI in real work, such as LLM APIs or agent frameworks like LangChain, LangGraph, or agent SDKs.
• Strong Go or Python skills with good engineering practices (testing, code review, CI/CD).
• Experience deploying and running production services on a public cloud.
• Clear writing for engineers and general audiences. Nice to have: GCP, published CVEs, MCP research, Terraform, reverse engineering.

Benefits

• Benefits to support health, finances, and well-being
• Flexible paid time off
• Team Member Resource Groups
• Equity compensation and Employee Stock Purchase Plan
• Growth and Development Fund
• Parental leave

Required Skills