Staff Security Engineer, IAM

GitLab is the intelligent orchestration platform for DevSecOps, trusted by 50 million+ registered users and more than half the Fortune 100. Every GitLab role is remote, and the company expects all team members to use AI as a core part of their daily workflow.

**The role**

You would join the Corporate Security Identity Team as a senior technical leader, moving the company from foundational identity controls to automated governance across its identity platforms and emerging AI tooling.

The framing is unusually direct about the engineering culture: GitLab says they are *"deliberately moving off click-ops and low-code platforms"* — configuration is becoming peer-reviewed code, and automation is becoming tested code running on GCP Cloud Run.

**What you'll do**

- Design identity and AI access solutions at scale, from AI agent governance frameworks to just-in-time privileged access that eliminates standing access
- Replace low-code automation with engineered services, migrating existing iPaaS work to Python services on GCP Cloud Run with source control, tests, CI and observability
- Codify identity platforms in Terraform, OpenTofu or Pulumi — leading the migration of Okta, Lumos and their NHI platform out of click-ops
- Re-architect identity and access across GCP and AWS organisations, covering resource hierarchy, secure-by-default guardrails, workload identity federation and least privilege
- Lead identity engineering for enterprise AI platforms including SSO and SCIM integration, audit logging and policy enforcement for **Claude (web, Claude Code, Cowork)** and adjacent tools
- Pioneer non-human identity governance for service accounts, API keys, certificates, AI agents and MCP integrations
- Mentor senior and intermediate engineers

**What you'll bring**

- Extensive IAM experience at Staff or senior IC level
- Expert-level Okta — Identity Engine, advanced authentication policies, lifecycle workflows, API automation
- Strong infrastructure-as-code practice with a track record of migrating click-ops to code
- Ability to write and ship production Python as a software engineer, deployed as services and instrumented for failure
- Cloud identity depth in GCP and/or AWS
- Hands-on experience administering enterprise AI platforms, Anthropic Claude preferred, plus awareness of prompt injection, MCP attack surface, agent identity and data leakage
- **A working practice of building with agentic tools** such as Claude Code or Cursor. GitLab is explicit that they want a practitioner whose instincts stay current, because the tooling landscape shifts monthly
- IGA platform experience such as Lumos or ConductorOne
- Regulated environment experience across FedRAMP, SOC 2 or SOX

**Compensation and benefits**

- **US salary range: $168,000 – $238,000.** The published range covers US residents; Canadian compensation is discussed during the process
- Equity compensation and an Employee Stock Purchase Plan
- Flexible paid time off
- Growth and Development Fund
- Parental leave
- Team Member Resource Groups

**Location**

This role is open to **Remote, Canada and Remote, United States**.

GitLab notes that it hires in countries around the world and that all roles are remote, but some carry location-based eligibility requirements — this is one of those. The application also asks whether you will require visa sponsorship to remain in your current location, so existing work authorisation is expected.

**Worth knowing before applying**

GitLab adds a note that many successful candidates do not meet every requirement, and specifically encourages applications from people who would otherwise self-select out.

The application asks directly whether you have expert-level Okta experience including Identity Engine, so that is a genuine gate rather than a preference.