GitLab's AI Governance team operates within the Secure, Scale, and Compliance sector, dedicated to providing organizations with the means to oversee and govern AI usage within the GitLab ecosystem. Our work addresses vital areas such as visibility (audit events, usage tracking, observability) and policy controls for protecting projects and ensuring compliance. We are expanding this team alongside a parallel AI Governance team, both contributing to a dynamic roadmap. As part of a distributed group of engineers, you will collaborate with adjacent AI and Continuous Delivery teams to integrate governance capabilities deeper into the platform. This is an exciting opportunity for engineers interested in emerging product challenges at the intersection of AI, compliance, and large-scale enterprise software.

About the Position

Introduction

As a Staff Backend Engineer specializing in AI Governance at GitLab, you will be instrumental in establishing the technical framework for managing GitLab Duo agents at an enterprise level. This critical role bridges AI systems, compliance, auditability, and backend architecture, focusing on creating robust systems that provide customers with clear visibility into AI agent activities and the necessary controls for managing their usage.

Responsibilities

Define and lead the backend architecture for AI governance systems, encompassing auditability, policy enforcement, and enterprise reporting functionalities to enhance governance coverage and facilitate reliable enterprise adoption.
Design the AI audit event system, including event schema, pipelines, storage patterns, retention considerations, and export interfaces, to ensure dependable audit visibility and support customer reporting and compliance.
Develop and guide the integration layer between the Duo Agent Platform and governance capabilities, ensuring that agent actions can be monitored and controlled at crucial execution points, thereby reducing governance gaps in agent workflows.
Provide technical design leadership for tool and registry governance, including metadata models, permissions, and controls for managed tool usage, leading to safer, more consistent, and more governable tool access.
Establish backend foundations for a declarative policy framework that dictates which agents and tools can be employed under specific conditions, assisting customers in consistently enforcing governance requirements across environments.
Promote architectural consistency and implementation quality across teams through the review of significant merge requests and contributions to technical RFCs, preventing design deviations as the product evolves.
Enhance team effectiveness and technical decision-making by mentoring engineers, offering design guidance and feedback, and coordinating efforts across teams to elevate the overall technical standard.
Accelerate delivery and improve consistency in shared initiatives by collaborating with engineering teams to align the governance architecture with existing platform patterns and the broader product strategy.

Requirements

Extensive experience designing and operating large-scale backend systems, particularly in areas demanding auditability, governance, or compliance.
Profound understanding of authorization and access control methodologies, such as role-based access control (RBAC), attribute-based access control (ABAC), and policy-as-code approaches.
Strong proficiency in Ruby on Rails within production SaaS environments.
Strong Python experience, especially for systems involved in AI services, orchestration layers, or service integrations.
Experience in designing REST APIs and GraphQL APIs for both internal and external platform use.
Familiarity with high-scale data and storage systems, including technologies like Postgres and ClickHouse.
Demonstrated experience leading substantial, cross-team technical projects in an asynchronous, RFC-driven engineering setting.
Ability to articulate technical decisions clearly in written and verbal communication, make informed tradeoffs during design and implementation, and influence technical direction across teams while collaborating effectively in a remote environment.