below marketmost similar roles pay hereabove market
This role pays less than
55%
of similar roles. Most pay
$176,600–$238,250
— the blue band above.
At the midpoint, this role pays about
$206k
versus about
$207k
for comparable roles.
Based on 240 similar postings.
Employer
About GitLab
GitLab is an all-remote software company that develops an AI-powered DevSecOps platform combining source code management, CI/CD, security scanning, and project planning in a single application.
GitLab currently has
53 open roles
on FindRole.
Listed pay typically runs
$152,800–$238,000
across 49 roles with salary data.
As a Staff Software Engineer on the Security Factory: Code Scanning team, you will set the technical direction for a static analysis engine that helps developers identify and remediate security vulnerabilities. You will own the architecture of the program model, including parsing source into intermediate representations, resolving symbols, building call graphs, and tracking tainted data across various languages. Your daily work involves defining specifications for AI agents to implement components, building tooling to validate findings against benchmark applications, and mentoring engineers. You must possess deep expertise in Rust, Go, or Ruby, along with experience in program analysis, ASTs, and data-flow analysis. The role requires applying security knowledge of OWASP and CWE standards to solve complex problems within the static application security testing domain.
What does a Software Engineer earn in Remote?
Median $208800 from 354 postings across 50 companies.
Set the technical direction and architecture for the static analysis engine and program modeling.
Act as the directly responsible individual for high-scope initiatives from design through delivery.
Define specifications for AI agents to implement, review, and validate engine changes and findings.
Build and maintain the harness and instructions that ensure agent-written code is trustworthy.
Own the pipeline that transforms source code into findings across various languages and frameworks.
Solve complex technical problems and advocate for improvements in quality, security, and performance.
Mentor engineers through code reviews, pairing, and the definition of internal technical standards.
Participate in on-call rotations to troubleshoot product operations and urgent engineering issues.
What we're looking for
Extensive professional experience writing, testing, and reviewing production code in Rust, Go, or a comparable systems language.
Deep program analysis and static analysis background including parsing, ASTs, intermediate representations, and taint or data-flow analysis.
Deep application security experience including vulnerability research, secure code review, and fluency with OWASP Top 10 and CWE.
Experience building LLM tooling, such as harnesses, agent pipelines, or evaluations, with the judgment to determine output trustworthiness.
Experience with performance optimization and containerized workflows and CI/CD using Docker.
Demonstrated capacity to communicate complex technical problems and write architecture and design specifications that drive team decisions.
Track record of taking ownership of ambiguous, team-wide problems and shipping them from concept to production with minimal guidance.
Experience defining overarching architecture, delegating specifications to engineers and AI agents, and mentoring engineers to raise the technical bar.
Familiarity with popular web or mobile application frameworks and how they handle input, data, and configuration (preferred).
Experience designing guardrails for agent-written code, such as mutation testing, fuzzing, and CI gates (preferred).
Record of engaging with the research community through publications, tool papers, or upstream open source contributions (preferred).