The opportunity
We work in a fully asynchronous organization, with most decisions made in documents or merge requests rather than meetings.
What you'll do
Implement authorization changes in GitLab's Ruby on Rails monolith so: permission checks allow intended access and deny unauthorized access.
Deliver well-scoped workstreams from feature-flagged rollout through: verifying that the old and new systems produce the same results, with review and guidance from senior engineers.
Build and extend fine-grained permissions for tokens and roles so additional: resources have permission coverage consistent with the established catalog.
Extend and fix authorization enforcement so GraphQL and the REST API enforce: the intended permissions consistently.
Make incremental refactors to long-lived policy code without changing behavior for existing customers.
Investigate and fix reliability, performance, and security issues so affected: permission checks return the expected results without regressions.
What they're looking for
- Work with the authentication, platform, and artificial intelligence (AI): teams to document interface contracts that keep permission checks consistent as authorization moves toward a shared service.
- Contribute to design documents, merge requests, and code reviews so proposed: changes have a documented rationale and review feedback is addressed asynchronously.
