Staff Security Engineer, IAM

GitLab is the intelligent orchestration platform for DevSecOps, trusted by 50 million+ registered users and more than half the Fortune 100. Every GitLab role is remote, and the company expects all team members to use AI as a core part of their daily workflow.

The role

You would join the Corporate Security Identity Team as a senior technical leader, moving the company from foundational identity controls to automated governance across its identity platforms and emerging AI tooling.

The framing is unusually direct about the engineering culture: GitLab says they are *"deliberately moving off click-ops and low-code platforms"* — configuration is becoming peer-reviewed code, and automation is becoming tested code running on GCP Cloud Run.

What you'll do

• Design identity and AI access solutions at scale, from AI agent governance frameworks to just-in-time privileged access that eliminates standing access
• Replace low-code automation with engineered services, migrating existing iPaaS work to Python services on GCP Cloud Run with source control, tests, CI and observability
• Codify identity platforms in Terraform, OpenTofu or Pulumi — leading the migration of Okta, Lumos and their NHI platform out of click-ops
• Re-architect identity and access across GCP and AWS organisations, covering resource hierarchy, secure-by-default guardrails, workload identity federation and least privilege
• Lead identity engineering for enterprise AI platforms including SSO and SCIM integration, audit logging and policy enforcement for Claude (web, Claude Code, Cowork) and adjacent tools
• Pioneer non-human identity governance for service accounts, API keys, certificates, AI agents and MCP integrations
• Mentor senior and intermediate engineers

What you'll bring

• Extensive IAM experience at Staff or senior IC level
• Expert-level Okta — Identity Engine, advanced authentication policies, lifecycle workflows, API automation
• Strong infrastructure-as-code practice with a track record of migrating click-ops to code
• Ability to write and ship production Python as a software engineer, deployed as services and instrumented for failure
• Cloud identity depth in GCP and/or AWS
• Hands-on experience administering enterprise AI platforms, Anthropic Claude preferred, plus awareness of prompt injection, MCP attack surface, agent identity and data leakage
• A working practice of building with agentic tools such as Claude Code or Cursor. GitLab is explicit that they want a practitioner whose instincts stay current, because the tooling landscape shifts monthly
• IGA platform experience such as Lumos or ConductorOne
• Regulated environment experience across FedRAMP, SOC 2 or SOX

Compensation and benefits

• US salary range: $168,000 – $238,000. The published range covers US residents; Canadian compensation is discussed during the process
• Equity compensation and an Employee Stock Purchase Plan
• Flexible paid time off
• Growth and Development Fund
• Parental leave
• Team Member Resource Groups

Location

This role is open to Remote, Canada and Remote, United States.

GitLab notes that it hires in countries around the world and that all roles are remote, but some carry location-based eligibility requirements — this is one of those. The application also asks whether you will require visa sponsorship to remain in your current location, so existing work authorisation is expected.

Worth knowing before applying

GitLab adds a note that many successful candidates do not meet every requirement, and specifically encourages applications from people who would otherwise self-select out.

The application asks directly whether you have expert-level Okta experience including Identity Engine, so that is a genuine gate rather than a preference.