GitLab
Senior Backend Engineer, SSCS: Supply Chain
Rol remoto de Sec Engineering con fit claro de ubicación del candidato.
PublicadoAgregado recientemente
Países elegibles1 país aceptado
Señal de senioritySenior
Modelo de trabajoRemoto
Ubicaciones aceptadas para candidatos
India
Resumen del rol
Senior Backend Engineer, SSCS: Supply Chain
Requisitos y responsabilidades
Contenido del rol extraído en secciones para revisar más rápido.
An overview of this role
- Building backend services for package policy enforcement and dependency control
- Implementing artifact signing, verification, and provenance workflows using the Sigstore ecosystem
What you’ll do
- Design and implement backend features across the Add-On's software supply chain security surface, including policy enforcement, artifact signing and verification, provenance attestation APIs, and malicious package detection integrations, delivering secure capabilities that meet enterprise customer requirements.
- Build and improve the package policy evaluation engine, including rule compilation, request matching, enforcement decisions, and performance-sensitive execution paths tied to GitLab's Dependency Firewall infrastructure, improving accuracy, reliability, and execution performance.
- Develop artifact signing and verification workflows, including Sigstore and Cosign integrations, signing key lifecycle management, keyless signing with OpenID Connect (OIDC), and policy-based promotion gates, enabling trusted and auditable software delivery.
- Create and evolve the configuration interfaces that enterprise security teams use, including backend APIs and the GraphQL surface for expressing supply chain security requirements, improving usability and adoption for customer administrators.
- Integrate Add-On capabilities with GitLab's existing security policy framework, including policy inheritance and policy-as-code support through YAML, expanding coverage across customer security workflows.
- Collaborate with adjacent teams as malicious package intelligence is incorporated into the Add-On offering, helping deliver cohesive workflows and faster response to package risk.
- Write and maintain comprehensive RSpec and integration test coverage, and help improve test reliability across the team, increasing confidence in releases and reducing regressions.
- Review merge requests with a security-first mindset and implement solutions with substantial decision-making scope in partnership with the Staff Backend Engineer, maintaining code quality and secure engineering standards.
What you’ll bring
- Proven backend engineering experience, including production Ruby on Rails expertise, as this is the team's primary language.
- Working knowledge of Go or a clear willingness and ability to ramp up quickly in it.
- Solid API design skills, including experience with REST, GraphQL, and defining clear internal service boundaries.
- Solid PostgreSQL fundamentals, including schema design, query optimization, and indexing strategies.
- Experience with Redis for caching and distributed coordination patterns.
- A security-aware engineering mindset, with sound judgment around trust boundaries, input validation, and failure modes.
- Familiarity with software supply chain security concepts such as Supply-chain Levels for Software Artifacts (SLSA), software bill of materials (SBOM), artifact signing, or related security scanning approaches.
- Interest in complex policy, registry, or platform problems, including areas such as rules engines, package ecosystems, cryptographic signing, or DevSecOps product development.
How GitLab Supports Full-Time Employees
- Benefits to support your health, finances, and well-being
- Flexible Paid Time Off
- Team Member Resource Groups
- Equity Compensation & Employee Stock Purchase Plan
- Growth and Development Fund
- Parental Leave
Roles similares
Mantén una lista de respaldo.
Stack
Usa estas tags para comparar roles remotos similares.
Elegibilidad de ubicación
Candidatos deberían aplicar solo cuando el país del perfil aparece aquí.
Tu perfilPaís no definidoInicia sesión para comparar tu país con este rol.
Flujo de contratación
WithMira muestra el rol y luego envía candidatos a la aplicación de la empresa.
1Revisa fit del rol, stack y elegibilidad de ubicación en WithMira.
2Abre la página de aplicación de la empresa desde el link rastreado.
3Guarda el rol o suscríbete a oportunidades similares antes de salir.