GitLab’s Infrastructure Security team is responsible for the planning, execution, and support of initiatives specific to the security of GitLab’s Infrastructure.
As stable counterparts from the Security department, the team members support specific Product Categories heavily reliant on Cloud and Infrastructure solutions. They collaborate with Development, Infrastructure, and Security teams across various product categories.
Infrastructure Security’s engagements take place in the form of infrastructure change reviews, SaaS infrastructure access & permissions models, cloud security best practices, operating system security, security monitoring at the host and container level, vulnerability management, and patching policies.
Some high-priority initiatives for the team are:
Further details can be found in the job family description.
| Person | Role |
|---|---|
| Julie Davila | VP, Product Security |
| Jacob Jernigan | Senior Manager, Infrastructure Security |
| Paulo Pontes Martins | Staff Security Engineer, Infrastructure Security |
| Dhruv Jain | Senior Security Engineer, Infrastructure Security |
| Matt Morrison | Senior Security Engineer, Infrastructure Security |
| Uday Govindia | Senior Security Engineer, Infrastructure Security |
@mention anyone. In case you want to mention the whole team, use the @gitlab-com/gl-security/product-security/infrastructure-security handle on GitLab.com.#security-infrasec channel or by tagging us @infrasec-team.Our preference is to work asynchronously, within our project issue tracker as described in the project management section below.
The team does have set of regular synchronous calls:
We use Epics, Issues, and Issue Boards to organize our work, as they complement each other:
Each project has an owner who is responsible for delivering the project.
The owner needs to:
Please use the following labels for project work only:
| Label | Use Case |
|---|---|
~"Department::InfraSec" |
Team Label (to be included in every project-related issue) |
~"InfraSec::triage" |
For new issues which need to be triaged |
~"InfraSec::this-quarter" |
For EPICs committed to the current quarter |
Before starting a new project, the team is encouraged to define software designs through design docs. These design doc documents the high level implementation strategy and key design decisions with emphasis on the trade-offs that were considered during those decisions.
To start discussing a new design:
6fe15a16)
