jobapplier

Staff Security Governance Engineer (Policies & Standards)

GitLab

Join GitLab as a Staff Security Governance Engineer, where you will own the lifecycle of security policies and standards, monitor emerging regulations, define KPIs for policy adherence, and support customer trust initiatives. You will work closely with various teams, including Security Compliance, Security Risk, and GRC Engineering, and report to the Director of Customer Trust & Security Governance. This remote-first position offers flexibility, equity compensation, and generous paid time off.

Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement

Additionally, studies have shown that people from underrepresented groups are less likely to apply to a job unless they meet every single qualification

If you're excited about this role, please apply and allow our recruiters to assess your application

USD 168,000 - 238,000

Responsibilities

  • Assurer la rédaction, la maintenance, la communication et la mesure des politiques et normes de sécurité de GitLab.
  • Surveiller les réglementations émergentes et collaborer avec l'équipe juridique pour évaluer l'impact et mettre à jour les politiques.
  • Définir les indicateurs clés de performance pour l'adhésion aux politiques et rendre compte des tendances à la direction de la sécurité.
  • A risk-based mindset that balances compliance with real security risk

Requirements

  • Working knowledge of SOC 2, ISO 27001, ISO 42001, FedRAMP, and NIST CSF, including how to put them into practice, not only how to read them
  • Experience collaborating with Security, Product, Legal, and Engineering
  • Strong written and verbal communication, including translating technical concepts for engineers, executives, auditors, and customers
  • Demonstrated use of automation or AI to reduce manual GRC work
  • 10+ years in security governance, GRC, or IT risk, with hands-on ownership of a policy and standards lifecycle and measurable outcomes, ideally at a global technology company
  • Understanding of cloud, SaaS, and DevSecOps practices, and the ability to write policy that engineers will follow

Preferred

  • Certifications such as CISSP, CISM, CISA, or similar are highly desirable

Every job at GitLab