Staff Product Security Architect at Gitlab

Gitlab

Remote, Canada; Remote, EMEA; Remote, US·1d ago

LeadFull-timeRustGraphQLCI/CDGitAI

Salary Range

$146,625 - $198,375 /year

Estimated

This salary is estimated based on similar roles. The actual salary may vary.

About the Role

We are seeking a Product Security Architect to join our Security Platforms & Architecture Team and serve as our strategic security partner for GitLab’s Core DevOps organization. This role focuses on anticipating security challenges, driving risk reduction, and enabling secure-by-default development of our CI/CD platform.

Key Responsibilities

→Serve as the dedicated security architect and strategic partner for Core DevOps functional leadership
→Lead security architecture and design work for strategic Core DevOps initiatives
→Identify, assess, and drive reduction of systemic security risks in the Product Security Risk Register
→Anticipate security challenges in upcoming Core DevOps initiatives and propose architectural solutions
→Coordinate with Application Security engineers to ensure comprehensive security review coverage
→Conduct security architecture reviews for large strategic projects
→Develop and communicate security standards and patterns specific to CI/CD security
→Collaborate with Security Research team members conducting proactive security exploration
→Cultivate strong relationships with Core DevOps technical leadership

Requirements

✓Deep expertise in CI/CD pipeline security, including runner isolation, secrets management, artifact security, and supply chain attack prevention
✓Strong understanding of source code management security, including merge request workflows, code review security, branch protection, and access control patterns
✓Proven experience securing DevOps toolchains and identifying systemic risks in continuous integration and delivery systems
✓Demonstrated ability to build trusted relationships with engineering leadership
✓Track record of proactive security architecture work - identifying risks before they become incidents
✓Strong background in application security with expertise in authentication/authorization, injection attacks, privilege escalation, and multi-tenant isolation
✓Experience translating complex security concepts into clear, actionable recommendations
✓Ability to operate strategically while remaining technically hands-on when needed