- Company: GitLab
- Location: Bangalore, India
- Job type: Full-time
About the role
GitLab is the intelligent orchestration platform for DevSecOps, trusted by over 50 million users and more than 50% of the Fortune 100. As an Intermediate Backend Engineer on the Authorization team, you will help build and maintain the system that determines what users, tokens, and automated agents can access on GitLab.com, Self-Managed, and Dedicated instances.
You will work alongside experienced engineers who guide larger design decisions, allowing you to deliver well-scoped changes while growing into ownership of larger system components. The role involves working with Ruby on Rails, where roughly 400 policy classes and about 1,900 permissions sit behind every API request. You will also contribute to moving the permission model to a new authorization stack that pairs the Rails monolith with a Rust policy engine.
Responsibilities
- Implement authorization changes in GitLab’s Ruby on Rails monolith to ensure permission checks allow intended access and deny unauthorized access.
- Deliver well-scoped workstreams from feature-flagged rollout through verifying that old and new systems produce the same results.
- Build and extend fine-grained permissions for tokens and roles to ensure additional resources have consistent permission coverage.
- Extend and fix authorization enforcement so GraphQL and REST APIs enforce intended permissions consistently.
- Make incremental refactors to long-lived policy code without changing behavior for existing customers.
- Investigate and fix reliability, performance, and security issues to ensure permission checks return expected results without regressions.
- Work with authentication, platform, and AI teams to document interface contracts that keep permission checks consistent.
- Contribute to design documents, merge requests, and code reviews to ensure proposed changes have documented rationale.
Requirements
- Solid experience building and maintaining production Ruby on Rails applications, typically gained over 2 to 4 years or more.
- Hands-on experience with authorization concepts, such as role-based access control or fine-grained permissions.
- A security mindset, treating permission bugs as security bugs and considering the impact of changes before implementation.
- Experience making careful changes to existing codebases, including incremental refactors and feature-flagged rollouts.
- Familiarity with GraphQL or API authorization patterns.
- Awareness of performance, including how repeated permission checks can add up on every request.
- Strong written communication and the ability to work effectively in an asynchronous environment.
- Helpful but not required: hands-on PostgreSQL experience, or experience with Rust, gRPC, Protocol Buffers, Cedar, Zanzibar-style authorization systems, Go, or service-oriented architecture.
Pay and benefits
- Flexible Paid Time Off.
- Team Member Resource Groups.
- Equity Compensation & Employee Stock Purchase Plan.
- Growth and Development Fund.
- Parental Leave.
How to apply
Apply directly on GitLab’s own careers website. Omadaily never charges job seekers.
