Staff Security Governance Engineer, Policies & Standards

This is a fully remote position, open to applicants in United States.

📋 Description

• Take ownership of the complete lifecycle for GitLab's security policies, standards, procedures, and guidelines.

• Establish and manage the exception management process, which includes risk-based approvals, expiry tracking, and trend analysis.

• Conduct policy attestation and investigate instances of non-compliance.

• Keep abreast of emerging regulations and standards, including those related to AI, and collaborate with Legal to update policies accordingly.

• Maintain connections between policies and frameworks like SOC 2, ISO 27001, ISO 42001, FedRAMP, and NIST CSF.

• Identify key performance indicators for policy compliance and communicate trends to Security leadership.

• Conduct focused internal assessments and ensure remediation is completed.

• Facilitate audits by organizing evidence, testing, and managing remediation efforts.

• Assist in addressing customer questionnaires and participating in customer meetings.

• Implement automation and AI-enhanced workflows for policy management, evidence gathering, control monitoring, and assessments.

• Serve as a technical and program leader across Security, Product, Legal, and Engineering departments.

• Provide mentorship to team members and contribute to the development of the Security Governance roadmap.

⛳️ Requirements

• Over 10 years of experience in security governance, GRC, or IT risk.

• Proven hands-on management of a policy and standards lifecycle with measurable results.

• Proficient understanding of SOC 2, ISO 27001, ISO 42001, FedRAMP, and NIST CSF.

• Familiarity with cloud, SaaS, and DevSecOps practices.

• Capability to draft policies that are practical and actionable for engineers.

• Risk-oriented mindset that balances compliance with actual security risks.

• Proven experience in employing automation or AI to minimize manual GRC tasks.

• Excellent written and verbal communication skills.

• Background in collaborating with Security, Product, Legal, and Engineering teams.

• Certifications such as CISSP, CISM, CISA, or similar qualifications are highly preferred.

🏝️ Benefits

• Comprehensive benefits to support your health, financial stability, and overall well-being.

• Flexible Paid Time Off policy.

• Access to Team Member Resource Groups.

• Equity Compensation and an Employee Stock Purchase Plan.

• Growth and Development Fund.

• Parental Leave benefits.

• A remote-first and asynchronous work environment.