GitLab
About this role
GitLab is hiring one dedicated threat intelligence engineer, and the posting is unusually honest that you would be the sole full time member of this team. The groundwork exists already: reporting templates, tooling, feeds, metrics and industry connections built by the Security Operations team over the last couple of years. Your job is to turn that framework into actual output, monitoring the threat landscape for credible threats to GitLab and to the software supply chain, tracking threat actors, supporting incident response with malware analysis, and running the Threat Intelligence Platform. Python is treated as the force multiplier here, used to automate collection and expand coverage. You would report to a Security Manager based in Australia. GitLab publishes no years figure for this role.
Who this is for
What the posting asks for:
- A proven track record of delivering actionable intelligence that measurably improved an organisation's security.
- Experience working with a Threat Intelligence Platform and managing ingested and exported threat feeds.
- Experience researching adversaries using OSINT and structured analytical techniques.
- The ability to automate tasks by writing scripts or programs, preferably in Python.
- Excellent written and verbal communication, with the ability to make complex topics clear.
Counts as a bonus:
- Experience reverse engineering malware, particularly macOS and Linux malware and malware delivered through code repositories.
- Public blogs or open source work related to threat intelligence.
The day to day: monitoring the threat landscape and raising ad hoc Flash Reports, administering the Threat Intelligence Platform and extending the open source, proprietary and internal collection pipeline, supporting incident response through malware analysis and threat actor tracking, collaborating on Purple Team Flash Operations where an emerging threat becomes a live exercise, building relationships with industry peers to share intelligence, and writing code and automation to make the team more efficient.
Experience: GitLab publishes no years figure, so we left it blank. The posting describes the person as a seasoned threat intelligence engineer and the level is Senior, but no number is given and we will not invent one.
Location: remote, open to Canada, India and the United States. Note the manager sits in Australia, so expect some meetings shifted towards Asia Pacific hours rather than a purely India schedule.
Team context worth reading carefully: you would be the only dedicated person on this team, supported by Security Operations engineers who spend part of their time on threat intelligence. That is a lot of autonomy and also a lot of solitude. Security Operations at GitLab also covers SIRT, Trust and Safety, Signal Engineering, Red Team and Security Logging.
Who should apply: someone who already does threat intelligence and wants to own a programme end to end rather than be one analyst among many. If you need a senior peer in the same specialism sitting next to you, read the team note again first.
- A proven track record of delivering actionable intelligence that measurably improved an organisation's security.
- Experience working with a Threat Intelligence Platform and managing ingested and exported threat feeds.
- Experience researching adversaries using OSINT and structured analytical techniques.
- The ability to automate tasks by writing scripts or programs, preferably in Python.
- Excellent written and verbal communication, with the ability to make complex topics clear.
Counts as a bonus:
- Experience reverse engineering malware, particularly macOS and Linux malware and malware delivered through code repositories.
- Public blogs or open source work related to threat intelligence.
The day to day: monitoring the threat landscape and raising ad hoc Flash Reports, administering the Threat Intelligence Platform and extending the open source, proprietary and internal collection pipeline, supporting incident response through malware analysis and threat actor tracking, collaborating on Purple Team Flash Operations where an emerging threat becomes a live exercise, building relationships with industry peers to share intelligence, and writing code and automation to make the team more efficient.
Experience: GitLab publishes no years figure, so we left it blank. The posting describes the person as a seasoned threat intelligence engineer and the level is Senior, but no number is given and we will not invent one.
Location: remote, open to Canada, India and the United States. Note the manager sits in Australia, so expect some meetings shifted towards Asia Pacific hours rather than a purely India schedule.
Team context worth reading carefully: you would be the only dedicated person on this team, supported by Security Operations engineers who spend part of their time on threat intelligence. That is a lot of autonomy and also a lot of solitude. Security Operations at GitLab also covers SIRT, Trust and Safety, Signal Engineering, Red Team and Security Logging.
Who should apply: someone who already does threat intelligence and wants to own a programme end to end rather than be one analyst among many. If you need a senior peer in the same specialism sitting next to you, read the team note again first.
Apply on company site
Opens job-boards.greenhouse.io, the employer's own application page. Applying is always free.