Engineering Manager, AST: Composition Analysis

GitLab is the intelligent orchestration platform for DevSecOps, enabling organizations to increase developer productivity and improve operational efficiency. As an Engineering Manager for Composition Analysis, you'll lead a team responsible for building software composition analysis capabilities to help customers identify and fix vulnerabilities in their application dependencies and software supply chain.

Responsibilities:

• Lead engineers across the Composition Analysis team, setting clear priorities and expectations
• Drive key security initiatives, including auto-remediation of vulnerable software packages, scanning unmanaged C/C++ dependencies, static reachability analysis, and snippet detection for open source dependencies
• Balance priorities and resources across the Composition Analysis team to ensure sustainable delivery and high-quality outcomes
• Author and maintain project plans for epics within the Composition Analysis team, aligning work, identifying dependencies, and ensuring quality delivery
• Run agile project management processes for the Composition Analysis team, including planning, estimation, and continuous improvement of delivery practices
• Provide guidance on the architecture of software composition analysis solutions, ensuring they are robust, scalable, and effective
• Collaborate closely with the Composition Analysis team to ensure consistent, high-quality approaches to application security across GitLab's platform

Requirements:

• Background leading multiple technical teams or groups, ideally in application security or cloud security
• Practical understanding of software composition analysis, including how to assess and manage risks in application dependencies
• Familiarity with containerization technologies, package managers, and dependency management systems
• Experience working with or around open source security tooling (for example, Syft, Grype, Trivy, or similar tools)
• Ability to plan and run agile project management processes for the Composition Analysis team, including coordinating priorities and dependencies
• Skill in guiding product and architecture decisions for security scanning tools, balancing technical constraints with customer needs
• Openness to candidates with transferable experience in security engineering, DevSecOps, or vulnerability management who are motivated to grow in application security leadership