Staff Security Governance Engineer (Policies & Standards)

Join GitLab as a Staff Security Governance Engineer, where you will own the lifecycle of security policies and standards, monitor emerging regulations, define KPIs for policy adherence, and support customer trust initiatives. You will work closely with various teams, including Security Compliance, Security Risk, and GRC Engineering, and report to the Director of Customer Trust & Security Governance. This remote-first position offers flexibility, equity compensation, and generous paid time off.

• Assurer la rédaction, la maintenance, la communication et la mesure des politiques et normes de sécurité de GitLab.
• Surveiller les réglementations émergentes et collaborer avec l'équipe juridique pour évaluer l'impact et mettre à jour les politiques.
• Définir les indicateurs clés de performance pour l'adhésion aux politiques et rendre compte des tendances à la direction de la sécurité.

• A risk-based mindset that balances compliance with real security risk
• Working knowledge of SOC 2, ISO 27001, ISO 42001, FedRAMP, and NIST CSF, including how to put them into practice, not only how to read them
• Experience collaborating with Security, Product, Legal, and Engineering
• Certifications such as CISSP, CISM, CISA, or similar are highly desirable
• Strong written and verbal communication, including translating technical concepts for engineers, executives, auditors, and customers
• Demonstrated use of automation or AI to reduce manual GRC work
• 10+ years in security governance, GRC, or IT risk, with hands-on ownership of a policy and standards lifecycle and measurable outcomes, ideally at a global technology company
• Understanding of cloud, SaaS, and DevSecOps practices, and the ability to write policy that engineers will follow
• Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement
• Additionally, studies have shown that people from underrepresented groups are less likely to apply to a job unless they meet every single qualification
• If you're excited about this role, please apply and allow our recruiters to assess your application