[All remote jobs](https://jobicy.com/jobs.md)[![GitLab logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/12/WRILS-201207055737-109952.jpg)](https://jobicy.com/company/gitlab.md)[GitLab](https://jobicy.com/company/gitlab.md) # Intermediate Security Engineer, Security Incident Response Team (SIRT) Review the role, location requirements, compensation details, and application process before deciding whether this opportunity fits your next career move. [Apply for this job](#job-application)[View company](https://jobicy.com/company/gitlab.md)ShareRemote from[Australia](https://jobicy.com/job-region/australia.md)SalaryUndisclosedDepartment[Cybersecurity](https://jobicy.com/categories/cybersecurity.md)EmploymentFull TimeExperienceSeniorPublished26 Oct 2026Apply before25 Nov 2026Listing views51Application actions2Application toolkit ## Make your next move. Prepare your resume, explore your fit, and draft a cover letter for this opportunity. AI Summary ## The role, at a glance. GitLab is hiring an intermediate Security Engineer for its Security Incident Response Team to detect, investigate, contain, and remediate security incidents affecting GitLab.com and the company. The role participates in a 24/7 coverage rotation on a compressed four-day schedule running Sunday through Wednesday. Responsibilities include incident leadership, forensic investigation, SIEM monitoring, root-cause analysis, incident documentation, and automation of security operations. The engineer will work with AWS and/or GCP, contribute Python-based tooling, and collaborate globally to strengthen detection and response capabilities. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 4/5EasyHard ### Pace & Pressure 5/5RelaxedFast-paced ### Autonomy Level 4/5GuidedFull ownership ### Communication Load 4/5IndependentCollaborative AI insightThis is a high-pressure incident-response role requiring sound judgment during active security events, technical investigation skills, and reliable execution of runbooks. The 24/7 rotation and responsibility for containment, recovery, and post-incident improvement increase the role's operational complexity. ## Salary analysis Estimated compensation compared with the broader US market for similar roles. Estimated job median (per year)Market rate$120,000US market range (per year)$100k–$145k0$159.50k AI insightThe yearly pay period is inferred from the job context; it was not explicitly stated by the employer. No employer salary was disclosed. The yearly cadence and USD market estimate are inferred for an intermediate security incident-response engineering position; actual compensation may vary by Australian hiring arrangement, location, and experience. ## Core skills Skills and capabilities most closely associated with this opportunity. [Incident response](https://jobicy.com/jobs?search_keywords=Incident%20response.md)[Security incident management](https://jobicy.com/jobs?search_keywords=Security%20incident%20management.md)[SIEM](https://jobicy.com/jobs?search_keywords=SIEM.md)[Security logging](https://jobicy.com/jobs?search_keywords=Security%20logging.md)[AWS](https://jobicy.com/jobs?search_keywords=AWS.md)[Google Cloud Platform](https://jobicy.com/jobs?search_keywords=Google%20Cloud%20Platform.md)[Python](https://jobicy.com/jobs?search_keywords=Python.md)[Digital forensics](https://jobicy.com/jobs?search_keywords=Digital%20forensics.md)[Threat investigation](https://jobicy.com/jobs?search_keywords=Threat%20investigation.md)[Root cause analysis](https://jobicy.com/jobs?search_keywords=Root%20cause%20analysis.md)[Security automation](https://jobicy.com/jobs?search_keywords=Security%20automation.md)[Runbook development](https://jobicy.com/jobs?search_keywords=Runbook%20development.md)[Detection engineering](https://jobicy.com/jobs?search_keywords=Detection%20engineering.md)[Technical documentation](https://jobicy.com/jobs?search_keywords=Technical%20documentation.md) Sample interview questionsDescribe how you would handle a potentially compromised cloud workload alert from initial detection through recovery.I would validate the alert using relevant logs and asset context, assess scope and business impact, and follow the incident runbook while documenting each action. If compromise is credible, I would contain the workload, preserve evidence, coordinate remediation with the owning team, and confirm recovery through monitoring. I would then lead or contribute to an RCA and update detections or procedures based on findings. How have you used a SIEM to distinguish a true positive from benign activity? I start by correlating the alert with identity, endpoint, cloud, network, and historical activity data. I compare the behavior against expected baselines, investigate related events and indicators, and verify whether the action was authorized. I document the conclusion and tune the detection when the investigation identifies a repeatable source of noise. What security tasks would you prioritize for automation with Python, and why? I would prioritize repeatable, evidence-heavy tasks such as alert enrichment, IOC lookups, log collection, ticket updates, and containment workflows with appropriate approval controls. Automation reduces response time and manual error while allowing responders to focus on judgment-intensive investigation and incident coordination. How would you conduct a useful post-incident review after a security event? I would create a blameless timeline covering detection, triage, containment, recovery, and communications. The review would identify root causes, contributing factors, control gaps, and specific owners for corrective actions. I would ensure the resulting lessons update runbooks, detections, automation, and stakeholder processes. How do you remain effective during a high-severity incident in a 24/7 response environment? I use established runbooks, prioritize containment and evidence preservation, and communicate concise status updates at regular intervals. I separate confirmed facts from assumptions, escalate early when needed, and keep an accurate incident record so handoffs are reliable. After resolution, I take time to capture improvements that make future responses faster and clearer. Opportunity details ## About this role. GitLab is the intelligent orchestration platform for DevSecOps. GitLab enables organizations to increase developer productivity, improve operational efficiency, reduce security and compliance risk, and accelerate digital transformation. More than 50 million registered users and more than 50% of the Fortune 100* trust GitLab to ship better, more secure software faster. The same principles built into our products are reflected in how our team works: we embrace AI as a core productivity multiplier, with all team members expected to incorporate AI into their daily workflows to drive efficiency, innovation, and impact. GitLab is where careers accelerate, innovation flourishes, and every voice is valued. Our high-performance culture is driven by our values and continuous knowledge exchange, enabling our team members to reach their full potential while collaborating with industry leaders to solve complex problems. [Co-create the future with us](https://www.youtube.com/watch?v=OuZIb5zszQI) as we build technology that transforms how the world develops software. *Fortune 500® is a registered trademark of Fortune Media IP Limited, used under license. Claim based on GitLab data. Fortune 100 refers to the top 20% ranked companies in the 2025 Fortune 500 list, published in June 2025. Fortune and Fortune Media IP Limited are not affiliated with, and do not endorse products or services of GitLab. An overview of this role As an Intermediate Security Engineer on GitLab’s Security Incident Response Team (SIRT), you will be on the frontline of protecting both GitLab.com and GitLab the company from security threats. This role operates on a compressed 4-day work schedule, with a full-time week’s hours condensed into four longer working days. Shifts run Sunday through Wednesday to provide 24/7/365 security coverage. Your primary focus will be detecting and responding to security incidents during your scheduled shifts. You’ll work extensively with our incident response automation tools to investigate, analyze, and resolve security events. You’ll also have opportunities to contribute to our security tooling and automation, helping to improve our detection and response capabilities. In this role, you’ll develop expertise using our security infrastructure to monitor for threats, analyze potential incidents, and coordinate response efforts across teams. This position is ideal for someone who wants to grow their incident response skills while working within GitLab’s established security framework. You’ll learn to think both tactically and strategically about security, while getting hands-on experience handling real-world incidents. Successful Security Engineers thrive in high-pressure environments, remaining calm while following prepared runbooks and thinking critically about security challenges. In this role, you will learn to think like both an attacker and defender, developing proactive and preventative security measures to keep GitLab and its users’ data safe in our ever-changing threat landscape. Through hands-on experience and mentorship, you’ll develop the skills needed to anticipate security risks, respond effectively to incidents, and contribute to GitLab’s robust security posture. Find out more about the Security Operations team and responsibilities here: * [Incident Response](https://handbook.gitlab.com/handbook/security/security-operations/sirt/) * [Trust and Safety](https://handbook.gitlab.com/handbook/security/security-operations/trustandsafety/) * [Red Team](https://handbook.gitlab.com/handbook/security/threat-management/red-team/#red-team-metrics) * [Threat-Intelligence](https://handbook.gitlab.com/handbook/security/security-operations/threat-intelligence/) * [Detection Engineering](https://handbook.gitlab.com/handbook/security/security-operations/signals-engineering/) What you’ll do * Lead security incident response in our 24/7 global rotation, managing incidents from detection through containment and recovery * Create and maintain comprehensive incident response documentation, including runbooks and standard procedures * Conduct post-incident analysis through RCA and lessons-learned reviews to strengthen our incident response program * Design and implement automated security processes to improve operational efficiency and reduce manual intervention * Drive continuous improvement by identifying security gaps and implementing advanced detection and response capabilities * Collaborate across GitLab teams to develop new security capabilities and deliver technical projects that enhance our infrastructure What you’ll bring * Demonstrated ability to learn and lead incident response processes independently * Experience with SIEM/security logging tools * Experience with cloud platforms (GCP and/or AWS) * Python programming skills or strong willingness to learn * A passion for technical documentation * Proactive approach to identifying and investigating security threats * Interest in conducting forensic analysis of infected hosts * Experience or strong desire to learn cloud-based security investigations About the team Security Operations is a globally distributed team of engineers split across 3 core regions; AMER, APAC and EMEA, and is at the forefront of security events that impact both GitLab.com and GitLab. We are both reactive and proactive, leading security investigations, incident response support and response resolution, through to cyber threat analysis and detection and response engineering. Even though we’re a global team, we work together in a cross-regional manner and have automation and processes to facilitate collaboration when resolving incidents, handovers, and general collaboration for project work as well. ### How GitLab Supports Full-Time Employees * [Benefits to support your health, finances, and well-being](https://about.gitlab.com/handbook/total-rewards/benefits/general-and-entity-benefits/) * [Flexible Paid Time Off](https://handbook.gitlab.com/handbook/people-group/time-off-and-absence/time-off-types/#flexible-paid-time-off-pto) * [Team Member Resource Groups](https://handbook.gitlab.com/handbook/company/culture/inclusion/tmrg-tmag/) * [Equity Compensation & Employee Stock Purchase Plan](https://handbook.gitlab.com/handbook/total-rewards/stock-options/) * [Growth and Development Fund](https://handbook.gitlab.com/handbook/people-group/learning-and-development/growth-and-development/) * [Parental Leave](https://about.gitlab.com/handbook/total-rewards/benefits/general-and-entity-benefits/#parental-leave) Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement. Additionally, studies have shown that people from [underrepresented groups](https://about.gitlab.com/company/culture/inclusion/#examples-of-select-underrepresented-groups) are less likely to apply to a job unless they meet every single qualification. If you’re excited about this role, please apply and allow our recruiters to assess your application. Country Hiring Guidelines: GitLab hires new team members in countries around the world. All of our roles are remote, however some roles may carry specific location-based eligibility requirements. Our Talent Acquisition team can help answer any questions about location after starting the recruiting process. Privacy Policy: Please review our [Recruitment Privacy Policy.](https://handbook.gitlab.com/handbook/hiring/candidate-faq/recruitment-privacy-policy/) Your privacy is important to us. GitLab is proud to be an equal opportunity workplace and is an affirmative action employer. GitLab’s policies and practices relating to recruitment, employment, career development and advancement, promotion, and retirement are based solely on merit, regardless of race, color, religion, ancestry, sex (including pregnancy, lactation, sexual orientation, gender identity, or gender expression), national origin, age, citizenship, marital status, mental or physical disability, genetic information (including family medical history), discharge status from the military, protected veteran status (which includes disabled veterans, recently separated veterans, active duty wartime or campaign badge veterans, and Armed Forces service medal veterans), or any other basis protected by law. GitLab will not tolerate discrimination or harassment based on any of these characteristics. See also [GitLab’s EEO Policy](https://about.gitlab.com/handbook/people-policies/inc-usa/#equal-employment-opportunity-policy) and [EEO is the Law](https://about.gitlab.com/handbook/labor-and-employment-notices/#eeoc-us-equal-employment-opportunity-commission-notices). If you have a disability or special need that requires [accommodation](https://about.gitlab.com/handbook/people-policies/inc-usa/#reasonable-accommodation), please let us know during the [recruiting process](https://about.gitlab.com/handbook/hiring/interviewing/#adjustments-to-our-interview-process). Show more [Apply now >](https://jobicy.com/jobs/157093-intermediate-security-engineer-security-incident-response-team-sirt.md) > Annual salary information is not provided for this position. Explore salary ranges for similar roles in our [Salary Directory ›](https://jobicy.com/salaries.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. * ![Huntress logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/91eae3ae-221.jpg) Huntress Oct 26 New ### [Security Operations Analyst – West Coast Shift](https://jobicy.com/jobs/157071-security-operations-analyst-west-coast-shift.md) What We Do: Cybercrime is growing, and more businesses are getting hit by threats that used to target only the biggest organizations. That pushes defenders like us to operate at… * ![Elevenlabs logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/e01b4c5d-221.png) Elevenlabs Oct 26 New ### [Infrastructure Security Engineer](https://jobicy.com/jobs/157064-infrastructure-security-engineer.md) About ElevenLabs ElevenLabs is an AI research and product company transforming how we interact with technology. We launched in January 2023 with the first human-like AI voice model. Today, we… * ![Tines logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/08/9285d376-221.png) Tines Oct 26 New ### [Senior Security Operations Engineer](https://jobicy.com/jobs/157058-senior-security-operations-engineer-4.md) Tines is the intelligent workflow company that powers some of the world’s most important workflows. Tines has been supporting IT and security teams from a diverse range of customers, including… * ![Phantom logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/08/3d0a3a49-221.png) Phantom Oct 26 New ### [Staff Platform Security Engineer (Security)](https://jobicy.com/jobs/154078-staff-platform-security-engineer-security.md) Phantom is on a mission to connect the world to the freedom of open markets. Tens of millions of people all over the world use Phantom to access global markets… * ![Wrapbook logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2024/03/4daf69c7-221.jpeg) Wrapbook Oct 25 New ### [GRC Principal – Data Privacy and Security](https://jobicy.com/jobs/157024-grc-principal-data-privacy-and-security.md) About Us: Wrapbook is the AI platform for production finance. We’re building a system of action that puts finance teams in control of their whole production, from payroll, to spend,… * ![Cyware logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/09/caccc6b44a54fecac5a7b8e4a4cf9548.jpeg) Cyware Oct 25 New ### [Senior Solutions Architect – Public Sector](https://jobicy.com/jobs/157011-senior-solutions-architect-public-sector.md) Job Title: Solutions Architect Location: Northern Virginia region or DC area. USA Reports To: VP of Solution Delivery & Customer Success About Cyware Cyware delivers an innovative approach to cybersecurity… * ![Ping Identity logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/09/63e8d5a6-221.png) Ping Identity Oct 25 New ### [Risk Manager](https://jobicy.com/jobs/156981-risk-manager.md) About Ping Identity: At Ping Identity, we believe in making digital experiences both secure and seamless for all users, without compromise. We call this digital freedom. And it’s not just… * ![TRM Labs logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/34aa038c-221.png) TRM Labs Oct 25 New ### [Global Investigator – Triage (APAC)](https://jobicy.com/jobs/156961-global-investigator-triage-apac.md) Build a Safer World. TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM’s platforms enable investigators to trace illicit activity, build… * ![TRM Labs logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/34aa038c-221.png) TRM Labs Oct 25 New ### [Global Investigator (APAC)](https://jobicy.com/jobs/156965-global-investigator-apac.md) Build a Safer World. TRM Labs provides AI-powered intelligence solutions that help public and private sector agencies investigate and disrupt crime. TRM’s platforms enable investigators to trace illicit activity, build… * ![Supabase logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/06/611d3bfa-221.png) Supabase Oct 25 New ### [Platform Security Engineer (AMER/APAC)](https://jobicy.com/jobs/156948-platform-security-engineer-amer-apac.md) About Supabase Supabase is the Postgres development platform, built by developers for developers. We provide a complete backend solution including Database, Auth, Storage, Edge Functions, Realtime, and Vector Search. All… [Browse all jobs](https://jobicy.com/jobs.md)