GitLab
Intermediate Security Engineer, Security Incident Response Team (SIRT)
Remote, Australia· REMOTE
About the role
The engineer leads incidents through detection, containment and recovery, maintains runbooks and runs root cause and lessons-learned reviews. The role also automates security processes and closes detection gaps. It follows a compressed Sunday–Wednesday schedule for 24/7/365 coverage.
What you will do
- Lead incident response from detection to recovery
- Maintain incident response documentation and runbooks
- Run root cause and lessons-learned reviews
- Automate security processes
- Identify gaps and improve detections
What they ask for
- Demonstrated ability to handle incidents independently
- Experience with SIEM and security logging
- GCP and/or AWS experience
- Python skills or willingness to learn
- Interest in technical documentation
- Remote within Australia
- Compressed Sunday–Wednesday shift schedule
Nice to have
- Forensic analysis of compromised hosts
- Cloud-based security investigations
What applying with Rooted means
This role accepts applications with Rooted context. Instead of sending only a resume, you can attach a verifiable credential with your proofs, rank, and technical evidence.
Your application includes your Rooted credential: rank, verified proofs, and supporting evidence.
You can read this role without an account. To apply you need a Rooted credential.
This role is curated by Rooted. Rooted is not the hiring company unless explicitly stated. The hiring company is GitLab. Confirm the final details with the original source or during the application process.
Posted 2026-09-09