Senior Security Engineer
Job Summary
As a Senior Security Engineer on the Security Incident Response Team (SIRT), you will lead critical incident investigations and defense operations. This role focuses on scaling security through automation, AI-driven workflows, and proactive threat detection. You will operate within a 24/7 global model, ensuring the security of GitLab’s cloud environments and infrastructure.
Responsibilities
- Lead end-to-end incident response and investigations
- Develop automation and AI-driven security workflows
- Design detection strategies and SIEM use cases
- Perform root cause analysis and post-incident reviews
- Collaborate cross-functionally and mentor engineers
Required Skills
- Strong DFIR and incident response experience
- Proficiency in AWS and GCP cloud platforms
- Experience with SIEM, EDR, and detection engineering
- Scripting/Automation skills (Python, SOAR)
- Knowledge of MITRE ATT&CK framework
Job Details
### Position Overview
As a Senior Security Engineer on GitLab’s Security Incident Response Team (SIRT), you will play a critical role in defending GitLab.com and the broader GitLab environment against evolving security threats. This role supports our FedRAMP environment and requires U.S. citizenship and residency within the United States.
### Responsibilities
- Lead and coordinate end-to-end incident response for high-severity security events within a 24/7 global on-call model.
- Prepare clear executive communications that keep stakeholders informed during incidents.
- Investigate complex security incidents across cloud environments, applying strong Digital Forensics and Incident Response (DFIR) methodologies.
- Partner with Signals Engineering to design and implement detection capabilities, including SIEM use cases, alerting strategies, and telemetry pipelines.
- Build and enhance automation and AI-assisted workflows to improve triage, investigation speed, and response consistency.
- Partner with Threat Intelligence to contextualize threats and improve detection coverage.
- Conduct root cause analysis (RCA) and lead post-incident reviews to drive continuous improvement and risk reduction.
- Develop and maintain runbooks, playbooks, and operational documentation.
- Collaborate cross-functionally during incidents and lead proactive initiatives (e.g., tabletops).
- Mentor other engineers and help elevate the team’s overall incident response maturity.
### Requirements
- Strong experience in security incident response and investigations in cloud-first environments.
- Experience using or administering Git/GitLab in a security or engineering context.
- Hands-on experience with SIEM, EDR, and/or detection engineering.
- Experience with cloud platforms (AWS & GCP).
- Familiarity with threat intelligence and adversary tactics (e.g., MITRE ATT&CK).
- Experience building or working with automation (e.g., Python, scripting, SOAR platforms).
- Interest or experience in applying AI/ML or data-driven techniques to detection, triage, or response workflows.
- Strong analytical and problem-solving skills; ability to operate effectively during high-severity incidents.
- Excellent written communication skills with a passion for clear, actionable documentation.
- Growth mindset with a proactive approach to identifying and mitigating security risks.
- Must be a United States Citizen to fill this position.