Intermediate Security Engineer, Security Incident Response Team (SIRT)

Imagine a role where every day brings a fresh challenge, protecting one of the world's leading DevSecOps platforms from ever-evolving threats. If you thrive on solving complex security puzzles, love diving deep into incidents, and want to contribute your expertise to a globally distributed, remote-first team, then this Intermediate Security Engineer position on our Security Incident Response Team at GitLab might be your next great adventure. We are looking for someone passionate about securing the future of software development, ready to make a significant impact from anywhere in the world.

Overview

GitLab is at the forefront of DevSecOps innovation, empowering organizations to build, secure, and deploy software faster and more efficiently. Our platform drives developer productivity, enhances operational efficiency, and mitigates security and compliance risks for millions of users worldwide. We embrace AI as a core productivity multiplier, integrating it into our daily workflows to foster innovation and impact. We are a high-performance culture, deeply committed to our values and continuous learning. This Intermediate Security Engineer role with our Security Incident Response Team (SIRT) is a fully remote, worldwide opportunity. You will play a crucial role in safeguarding GitLab's infrastructure, applications, and data, protecting our customers and our mission.

Key Responsibilities

Respond promptly to security incidents, performing comprehensive analysis, containment, eradication, and recovery.
Conduct in-depth forensic investigations across various platforms, including cloud environments, endpoints, and networks.
Develop and implement detection rules, automation scripts, and playbooks to enhance incident response capabilities.
Collaborate closely with engineering, operations, and product teams to integrate security best practices and improve system resilience.
Participate in an on-call rotation to provide 24/7 incident response coverage.
Identify emerging threats and vulnerabilities, contributing to proactive threat hunting initiatives.
Document incident details, findings, and remediation steps meticulously to support post-incident reviews and continuous improvement.

Requirements

Several years of hands-on experience in a Security Incident Response or Security Operations Center role.
Strong understanding of the incident response lifecycle and methodologies.
Proficiency with cloud security concepts and platforms such as AWS or Google Cloud Platform.
Solid grasp of operating system internals (Linux preferred), networking protocols, and common attack techniques.
Experience with security tools like SIEM, EDR, IDS/IPS, and vulnerability management solutions.
Ability to script or automate tasks using languages such as Python, Go, or Ruby.
Excellent analytical and problem-solving skills, with a keen eye for detail.
Effective communication skills, both written and verbal, for technical and non-technical audiences.
Demonstrated ability to remain calm and effective under pressure during critical incidents.

What You'll Gain

The chance to work on challenging and impactful security problems at a leading global technology company.
Accelerated professional growth and continuous learning opportunities within a supportive, expert team.
Exposure to a cutting-edge DevSecOps platform and a culture that actively embraces AI for productivity.
The flexibility and autonomy of a fully remote work environment, collaborating with colleagues across the globe.
Direct contribution to a widely used open-source product and a vibrant community.
A culture that values every voice, promotes continuous knowledge exchange, and invests in your full potential.