Staff Backend Engineer, Software Supply Chain Security

Stack

Responsibilities

• ▹Define and drive technical architecture for the SSCS Add-On: package policy enforcement, provenance generation, artifact signing, malicious package detection
• ▹Lead design and implementation of SLSA Level 2 and 3 capabilities within GitLab CI/CD
• ▹Architect integrations with Sigstore services (Cosign, Fulcio, Rekor)
• ▹Design backend services and request paths for allow/deny/quarantine package policies
• ▹Review merge requests for security, architectural consistency, and test quality
• ▹Mentor Backend Engineers across experience levels
• ▹Partner with Product, Infrastructure, Authentication, Authorization, and Security teams

Requirements

• ▹Strong experience building backend applications with Ruby on Rails at high-scale production
• ▹Professional Go experience for backend or infrastructure services
• ▹Track record leading architecture across multiple systems
• ▹Experience writing clear technical proposals, RFCs, and decision records in an async, documentation-first environment
• ▹Solid security mindset, comfortable with trust and risk-reduction as central requirements
• ▹Familiarity with software supply chain security concepts: build provenance, artifact signing, dependency security, SBOM
• ▹Strong teamwork and communication across distributed teams

Soft skills

What we offer

• ▹Flexible Paid Time Off
• ▹Team Member Resource Groups
• ▹Equity Compensation & Employee Stock Purchase Plan
• ▹Growth and Development Fund
• ▹Parental Leave

About the company

GitLab is the intelligent orchestration platform for DevSecOps. The SSCS Add-On team, part of the Software Supply Chain Security stage, is building a commercial offering addressing real supply chain security challenges for enterprise customers.