Senior Backend Engineer, SSCS: Supply Chain

2 months ago
Full-time
Senior
Software Development
GitLab

GitLab

GitLab: The comprehensive DevOps platform revolutionizing software development with automation, AI workflows, and essential tools for efficient collaboration.

Internet Software & Services
1K-5K
Founded 2014

Description

  • Design and implement backend features across the software supply chain security Add-On, including policy enforcement, signing and verification, provenance attestation, and malicious package detection integrations.
  • Build and improve the package policy evaluation engine, including rule compilation, request matching, enforcement decisions, and performance-sensitive execution paths.
  • Develop artifact signing and verification workflows using Sigstore and Cosign, including signing key lifecycle management, keyless signing with OIDC, and policy-based promotion gates.
  • Create and evolve backend APIs and GraphQL interfaces for enterprise security teams to express supply chain security requirements.
  • Integrate Add-On capabilities with GitLab's security policy framework, including policy inheritance and policy-as-code support through YAML.
  • Collaborate with adjacent teams to incorporate malicious package intelligence into the Add-On offering.
  • Write and maintain comprehensive RSpec and integration tests, and help improve test reliability across the team.
  • Review merge requests with a security-first mindset and help implement solutions with substantial decision-making scope.

Requirements

  • Production experience with Ruby on Rails backend engineering.
  • Working knowledge of Go or the ability and willingness to ramp up quickly.
  • Experience designing APIs, including REST and GraphQL, and defining clear internal service boundaries.
  • Strong PostgreSQL fundamentals, including schema design, query optimization, and indexing strategies.
  • Experience with Redis for caching and distributed coordination patterns.
  • A security-aware engineering mindset with sound judgment around trust boundaries, input validation, and failure modes.
  • Familiarity with software supply chain security concepts such as SLSA, SBOM, artifact signing, or related security scanning approaches.
  • Interest in complex policy, registry, or platform problems such as rules engines, package ecosystems, cryptographic signing, or DevSecOps product development.

Benefits

  • Benefits to support health, finances, and well-being.
  • Flexible Paid Time Off.
  • Equity compensation and an Employee Stock Purchase Plan.
  • Growth and Development Fund.
  • Parental leave.
  • Home office support.
  • Team Member Resource Groups.

Interested in this position?

Apply directly on the company website

Apply Now

Similar Roles

Senior Java Engineer - Distributed Systems - Elasticsearch

Elastic 1K-5K Internet Software & Services

Elastic is hiring a Senior Software Engineer for the Elasticsearch Distributed Systems team to improve cluster-scale indexing, coordination, and resilience across a highly distributed search platform.

Elasticsearch Java Lucene
4 hours, 41 minutes ago

Senior Java Engineer - Distributed Systems - Elasticsearch

Elastic 1K-5K Internet Software & Services

Elastic is hiring a Senior Software Engineer for its Elasticsearch Distributed Systems team to improve the scale, performance, and resilience of clustered search infrastructure.

Elasticsearch Java Lucene
4 hours, 41 minutes ago

Senior Java Engineer - Distributed Systems - Elasticsearch

Elastic 1K-5K Internet Software & Services

Elastic is hiring a Senior Software Engineer for its Elasticsearch Distributed Systems team to help improve the scale, performance, and resilience of the cluster systems that handle indexing, allocation, replication, and node coordination.

Elasticsearch Java Lucene
4 hours, 41 minutes ago

Senior Software Engineer - Fullstack (Backend Focused)

New Relic 1K-5K Internet Software & Services

New Relic is hiring a backend engineer to help build a new observability experience and next-generation platform services for distributed systems in an AI-first environment.

Agile CI/CD Docker Git GraphQL Java Kafka Kubernetes Microservices React REST API Spring Boot TypeScript
4 hours, 41 minutes ago

You're on a roll! Sign up now to keep applying.

Sign Up

Already have an account? Log in

Used by 14,729+ remote workers