Senior Security Engineer, Security Incident Response Team (SIRT) - EMEA

GitLab is the intelligent orchestration platform for DevSecOps, trusted by more than 50 million registered users and over 50% of the Fortune 100. The Security Incident Response Team (SIRT) is a globally distributed team operating across AMER, APAC, and EMEA focused on security events impacting GitLab.com and GitLab cloud and corporate environments.

• Strong experience in security incident response and investigations in cloud-first environments
• Experience using or administering Git/GitLab in a security or engineering context
• Hands-on experience with SIEM, EDR, and/or detection engineering
• Experience with cloud platforms (AWS, GCP)
• Familiarity with threat intelligence and adversary tactics (e.g., MITRE ATT&CK)
• Experience building or working with automation using Python, scripting, or SOAR platforms
• Interest or experience applying AI/ML or data-driven techniques to detection, triage, or response workflows
• Strong analytical and problem-solving skills to operate effectively during high-severity incidents
• Excellent written communication skills with a passion for clear, actionable documentation
• Growth mindset with a proactive approach to identifying and mitigating security risks

• Lead and coordinate end-to-end incident response for high-severity security events within a 24/7 global on-call model during EMEA business hours
• Prepare clear executive communications during incidents
• Investigate complex security incidents across cloud environments using Digital Forensics and Incident Response (DFIR) methodologies
• Partner with Signals Engineering to design and implement detection capabilities, including SIEM use cases, alerting strategies, and telemetry pipelines
• Build and enhance automation and AI-assisted workflows to improve triage, investigation speed, and response consistency
• Partner with Threat Intelligence to contextualize threats and improve detection coverage
• Conduct root cause analysis (RCA) and lead post-incident reviews to drive continuous improvement and risk reduction
• Develop and maintain runbooks, playbooks, and operational documentation
• Collaborate cross-functionally during incidents and lead proactive initiatives such as tabletops
• Mentor other engineers and help elevate the team’s incident response maturity

This role operates during EMEA business hours as part of a 24/7 global on-call model. GitLab hires globally with some location-based eligibility requirements. The company is an equal opportunity employer and provides accommodations during the recruiting process if needed.