Apply on Employer Site

GitLab · 4 months ago

Software Engineering Manager, Application Security Testing: Composition Analysis & Dynamic Analysis

United States

Full-time

Remote

Senior Level

$132K/yr - $282K/yr

GitLab is an open-core software company that develops the most comprehensive AI-powered DevSecOps Platform, used by more than 100,000 organizations. The Engineering Manager for Composition Analysis and Dynamic Analysis specializes in leading teams focused on application security scanning technologies and is responsible for managing multiple security-focused engineering groups.

Cloud SecurityDeveloper ToolsDevOpsOpen SourceSaaS

Comp. & Benefits

Responsibilities

Manage engineers across both the Composition Analysis and Dynamic Analysis groups

Drive key initiatives including:

Auto-remediation of vulnerable software packages

Scanning of unmanaged dependencies in C/C++

Static reachability analysis with function-level granularity

Snippet detection for open source dependencies

Improve the DAST crawler for efficiency, stability, and consistent web application traversal

Balance priorities across multiple security-focused engineering teams

Author project plans for epics across both groups, ensuring alignment and avoiding duplication of effort

Run agile project management processes for multiple teams

Provide guidance on security product architecture

Coordinate between Composition Analysis and Dynamic Analysis teams to ensure consistent and complementary approaches to application security

Qualification

Application SecuritySoftware Composition AnalysisDynamic Analysis Security TestingContainerization TechnologiesVulnerability ManagementDevSecOps PracticesAgile Project ManagementOpen Source Security ToolingWeb Application Security TestingTeam Management

Required

In-depth understanding of application security concepts, particularly in software composition analysis techniques to evaluate the security risks associated with application dependencies and dynamic analysis security testing (DAST) tools

Understanding of the challenges in developing and maintaining security scanning tools

Experience managing multiple technical teams simultaneously

Familiarity with containerization technologies and dependency management systems

Knowledge of web application security testing techniques and tools

Experience with open source security tooling (such as OWASP ZAP, Trivy, or similar)

Experience in DevSecOps practices and implementation

Experience in vulnerability management and remediation