Senior Infrastructure Security Engineer

GitLab is an open-core software company that develops the most comprehensive AI-powered DevSecOps Platform. As a Senior Infrastructure Security Engineer, you will lead cross-team infrastructure security initiatives and design security solutions for GitLab's SaaS Platforms, collaborating with various stakeholders to ensure resilient and secure cloud infrastructure.

Responsibilities:

• Lead cross-team infrastructure security initiatives from design through delivery, owning technical outcomes and stakeholder communication
• Design and implement security solutions for cloud infrastructure, container platforms, and orchestration systems
• Drive security reviews for infrastructure changes, providing guidance and identifying risks before they reach production
• Develop secure patterns and reference implementations that enable engineering teams to deliver secure infrastructure quickly
• Identify systemic security gaps in cloud, Kubernetes, and infrastructure configurations, then lead remediation efforts across affected systems
• Partner with SRE, Infrastructure, and Engineering teams to integrate security into platform services and deployment pipelines
• Mentor and partner with engineers supporting their professional development
• Contribute to the team's technical roadmap, identifying high-impact security improvements aligned with business objectives
• Fulfill the Product Security Division Mission of securing GitLab Infrastructure with our own product (“dogfooding”)

Requirements:

• Strong experience securing cloud infrastructure at scale (AWS/GCP/Azure), including IAM, networking, compute, and storage services
• Proficiency in multiple programming languages (Go, Python, Ruby) with ability to build production-quality security tooling
• Deep knowledge of container security, Kubernetes hardening, and orchestration platform security best practices
• Extensive experience with Infrastructure-as-Code security (Terraform, Ansible, CloudFormation) including policy-as-code and automated compliance
• Experience with or strong interest in leveraging AI to automate processes increasing efficiency
• Experience leading technical initiatives across multiple teams with demonstrated ability to drive consensus and deliver results
• Track record of identifying security risks in complex systems and implementing effective mitigations
• Strong written and verbal communication skills, able to explain security trade-offs to both technical and non-technical audiences
• Share our values, and work in accordance with those values
• Experience in high-reliability domains (e.g. finance, healthcare, government, telecom)
• Familiarity with regulatory and compliance frameworks (e.g. PCI-DSS, FedRAMP, ISO27001, SOC II)