Specialty
The role
GitLab is hiring a Senior Security Risk Engineer for its Security Risk team in Security Assurance. You would own risk identification and remediation tracking across third-party risk, risk assessments and security findings, and automate that work with scripts and AI. Reports to the Security Risk Manager.
What you will do
- Identify, analyze and prioritize risk across third-party risk, security risk assessments and security findings using an established framework
- Turn technical vulnerabilities and control gaps into quantified risk statements that leaders can act on
- Drive remediation of findings and risk exceptions to closure with Engineering, IT, Product and Legal
- Maintain the risk register and quarterly reporting for leadership
- Own AI risk management, including impact and risk assessments, to support ISO 42001 certification
- Build automation, scripts or AI tooling to remove manual steps in risk and TPRM workflows
What they ask for
- 5+ years in security risk management using frameworks such as NIST RMF, NIST 800-39 or ISO 31000
- Experience running qualitative and quantitative risk analyses that show business impact
- Track record driving risk assessments, risk registers and remediation across IT, Procurement, Audit, Legal, Product and Engineering
- Has personally built scripts, workflows or AI tooling that cut manual GRC work
- Strong written and verbal communication, translating security risk into business risk
- Understanding of cloud security, SaaS security models and DevSecOps
- Familiarity with AI governance frameworks such as ISO 42001 or NIST AI RMF is a plus
- CISSP, CISM, CISA or CRISC preferred but not required
This is our own short reading of the posting. The full description, and anything that has changed since, is on GitLab's careers page behind the apply button.
