Intermediate Backend Engineer, Authorization

Intermediate Backend Engineer on GitLab's Authorization team, building the system that decides what every user, token and agent can access across GitLab.com, Self-Managed and Dedicated.

• 1Implement authorization changes in GitLab's Ruby on Rails monolith so permission checks allow intended access and deny unauthorized access
• 2Deliver well-scoped workstreams from feature-flagged rollout through verifying that the old and new systems produce the same results, with review and guidance from senior engineers
• 3Build and extend fine-grained permissions for tokens and roles so additional resources have permission coverage consistent with the established catalog
• 4Extend and fix authorization enforcement so GraphQL and the REST API enforce the intended permissions consistently
• 5Make incremental refactors to long-lived policy code without changing behavior for existing customers
• 6Investigate and fix reliability, performance, and security issues so affected permission checks return the expected results without regressions

• Solid experience building and maintaining production Ruby on Rails applications, typically gained over 2 to 4 years or more
• Hands-on experience with authorization concepts, such as role-based access control or fine-grained permissions, from work or projects
• A security mindset: you treat a permission bug as a security bug and consider who a change could affect before choosing an implementation
• Experience making careful changes to existing codebases, including incremental refactors and feature-flagged rollouts that preserve existing behavior
• Familiarity with GraphQL or API authorization patterns
• Awareness of performance, including how repeated permission checks can add up on every request