Senior Security Engineer – Security Incident Response (EMEA)

About the role

As a Senior Security Engineer on GitLab’s Security Incident Response Team (SIRT), you will defend GitLab.com and the broader environment against evolving threats, operating on a compressed 4‑day work schedule to provide 24/7/365 coverage.

Key responsibilities

• Lead end‑to‑end incident response for high‑severity security events across a 24/7 global on‑call model during EMEA business hours.
• Investigate complex incidents in cloud environments using Digital Forensics and Incident Response (DFIR) methodologies.
• Partner with Signals Engineering to design SIEM use cases, alerting strategies, and telemetry pipelines.
• Build and enhance automation and AI‑assisted workflows to accelerate triage and response.
• Conduct root‑cause analysis and post‑incident reviews to drive continuous improvement.
• Develop and maintain runbooks, playbooks, and operational documentation.

Required profile

• Strong experience in security incident response and investigations in cloud‑first environments.
• Hands‑on experience with SIEM, EDR, and detection engineering.
• Familiarity with threat intelligence frameworks such as MITRE ATT&CK.
• Proficiency in automation using Python, scripting, or SOAR platforms.
• Excellent written communication and ability to produce clear executive briefings.

Required skills

• Security incident response
• Digital Forensics and Incident Response (DFIR)
• Git / GitLab
• SIEM
• EDR
• AWS
• GCP
• Python
• Scripting
• SOAR platforms
• AI/ML for detection
• MITRE ATT&CK

What we offer

• Flexible paid time off
• Equity compensation and employee stock purchase plan
• Growth and development fund
• Parental leave
• Remote‑first work environment