Specialty
The role
GitLab is hiring a Staff Security Governance Engineer to own how it writes, maintains and measures security policies and standards. The role sits in Security Assurance and reports to the Director, Customer Trust & Security Governance. GitLab works remote-first and asynchronously.
What you will do
- Own the lifecycle of security policies and standards, from drafting and approval to annual review and retirement
- Run the exception process and policy attestation, and investigate non-adherence
- Track new regulations, including AI rules, and update policy with Legal
- Map policies to frameworks such as SOC 2, ISO 27001 and NIST CSF
- Define adherence KPIs, run internal assessments and support audits and customer questionnaires
- Build automation and AI-assisted workflows for policy and evidence work with GRC Engineering
What they ask for
- 10+ years in security governance, GRC or IT risk, with ownership of a policy and standards lifecycle
- Working knowledge of SOC 2, ISO 27001, ISO 42001, FedRAMP and NIST CSF
- Understanding of cloud, SaaS and DevSecOps practices
- Ability to write policy that engineers will follow
- Risk-based mindset balancing compliance and real security risk
- Experience using automation or AI to reduce manual GRC work
- Strong written and verbal communication with engineers, executives, auditors and customers
- CISSP, CISM, CISA or similar is highly desirable
This is our own short reading of the posting. The full description, and anything that has changed since, is on GitLab's careers page behind the apply button.
