Senior Software Engineer, Ruby – Security Platform: Authorization

This is a fully remote position, open to applicants in United States, +2 more countries.

📋 Description

• Take ownership of key components of the system that dictate user, token, and automated agent access across GitLab.com, Self-Managed, and Dedicated environments.

• Design and implement authorization modifications within GitLab's Ruby on Rails monolith.

• Manage workstreams from problem identification to feature-flagged deployment, dual-run validation, and subsequent cleanup.

• Develop and enhance detailed permissions for tokens and roles.

• Maintain an organized permission catalog.

• Strengthen and extend authorization enforcement across GraphQL and REST APIs.

• Refactor policy code to ensure seamless evaluation by both the monolith and the new authorization engine without disrupting existing customer experiences.

• Enhance the reliability, performance, and security of authorization systems.

• Collaborate with authentication, platform, AI, and modular-service teams.

• Influence technical choices through design documentation, architecture decision records, and code reviews.

⛳️ Requirements

• Extensive experience in building and maintaining production Ruby on Rails applications.

• Background in designing or implementing authorization systems, including role-based access control and detailed permissions.

• A security-focused mindset with the ability to assess blast radius implications.

• Proficiency in making intentional changes within large, long-standing codebases.

• Experience with incremental refactoring, feature-flagged rollouts, and migrations.

• Familiarity with GraphQL and API authorization methodologies.

• Understanding of performance considerations at scale.

• Excellent written communication skills.

• Beneficial but not mandatory: experience with Rust, gRPC or Protocol Buffers, Cedar or similar policy languages, Zanzibar-style authorization systems, Go, or service-oriented architecture.

• Relevant experience from related fields such as identity management, policy engines, and platform security.

• Capability to function effectively in a fully asynchronous work environment.

🏝️ Benefits

• Comprehensive benefits to support your health, financial stability, and overall well-being.

• Flexible Paid Time Off.

• Access to Team Member Resource Groups.

• Equity Compensation & Employee Stock Purchase Plan.

• Growth and Development Fund.

• Parental Leave.