Senior Software Engineer (Ruby), Security Platform: Authorization

An overview of this role

As a Senior Software Engineer on GitLab's Authorization team, you will own significant parts of the system that decides what every user, token, and automated agent can access on GitLab.com, Self-Managed, and Dedicated.

Today that work is Ruby on Rails. Roughly 400 policy classes and a YAML catalog of about 1,900 permissions sit behind every API request. You will work on the permission model itself (fine-grained token permissions, custom roles, and the GraphQL and REST surfaces that enforce them). You will also help move that model onto GitLab's next-generation authorization stack, which pairs the Rails monolith with a Rust policy engine using Zanzibar-style relationship tuples and Cedar policies. The monolith already loads that engine in-process and can reach it over gRPC.

Some examples of our projects:

• Refactoring GitLab's policy layer so the same permission definitions can be evaluated by the monolith and by our new authorization service
• Extending fine-grained token permissions to more resources and more kinds of principal, including the service identities behind AI agents
• Bringing GitLab's first modular service, Artifact Registry, onto the new authorization stack
• Isolating custom-role and permission data per organization ahead of GitLab Cells

What you’ll do

• Design and ship authorization changes in GitLab's Ruby on Rails monolith, where a single request can trigger hundreds of permission checks.
• Own a workstream end to end. Problem definition through feature-flagged rollout, dual-run verification, and cleanup.
• Build and extend fine-grained permissions for tokens and roles, and keep the permission catalog coherent as it grows.
• Extend and harden authorization enforcement across GraphQL and the REST API.
• Refactor long-lived policy code so both the monolith and our new authorization engine can evaluate it, without changing behavior for existing customers.
• Improve the reliability, performance, and security posture of existing authorization systems, including paying down permission-model debt.
• Partner with the authentication, platform, AI, and modular-service teams on interface contracts as authorization moves toward a shared service.
• Drive technical decisions in writing. Design docs, architecture decision records, and code review, in a fully asynchronous organizat