Senior Security Risk Engineer

View Company

Role Snapshot

Hiring Now

Work arrangement: Remote
Where applicants may be: Applicants in United States only
Salary: Not specified
Apply by: Not specified
Employment type: Full-time
Experience: Not specified

Published1h ago

Listing Views0

Applications0

Apply BeforeNo deadline

Career Tools

About This Role

GitLab operates an intelligent orchestration platform for DevSecOps, helping organizations boost developer productivity, streamline operations, and minimize security and compliance risks. The company seeks a Senior Security Risk Engineer to join its remote team on a full-time basis. In this capacity, you will take charge of risk identification, quantification, and remediation tracking across the entire business. This position is well-suited for a professional who enjoys modernizing risk processes through automation,…

Job Description

GitLab operates an intelligent orchestration platform for DevSecOps, helping organizations boost developer productivity, streamline operations, and minimize security and compliance risks. The company seeks a Senior Security Risk Engineer to join its remote team on a full-time basis. In this capacity, you will take charge of risk identification, quantification, and remediation tracking across the entire business.

This position is well-suited for a professional who enjoys modernizing risk processes through automation, scripting, and artificial intelligence. You will report directly to the Security Risk Manager and work alongside departments such as Legal, IT, Product, and Engineering. Core duties involve translating technical vulnerabilities into business-oriented risk statements, managing third-party risk, executing security risk assessments, and maturing AI risk management in alignment with ISO 42001 certification goals.

The role requires managing multiple concurrent assessments, designing key risk indicators, and building automated tools to eliminate repetitive workflows. Candidates should thrive in environments with ambiguity and possess strong communication abilities to brief leadership on top risks and remediation progress.

Responsibilities

Manage risk identification, analysis, and prioritization across third-party risk, security risk assessments, and findings using recognized frameworks like NIST RMF or ISO 31000
Convert technical vulnerabilities and control gaps into clear, quantified risk statements for leadership and non-security stakeholders
Collaborate with Engineering, IT, Product, and Legal to drive the closure of risk exceptions and findings while escalating stalled items
Maintain and mature a comprehensive risk register alongside a quarterly reporting cadence
Oversee AI risk management operations, covering AI impact and risk assessments to support ISO 42001 certification
Design and implement key risk indicators and metrics for top identified risks
Develop custom automation scripts and AI-driven tooling to eliminate manual, repetitive tasks in risk and TPRM workflows
Contribute to the risk program roadmap by integrating new regulatory changes, frameworks, and lessons learned
Scan the internal and external risk environment to identify and escalate emerging threats proactively

Requirements

Minimum of 5 years of professional experience in security risk management utilizing frameworks such as NIST RMF, NIST 800-39, or ISO 31000
Demonstrated background in designing and conducting qualitative and quantitative risk analyses that link technical risks to measurable business outcomes
Proven history of driving risk assessments, registers, and remediation efforts to completion across multiple departments in complex or regulated environments
Demonstrated ability to interpret technical control requirements for both technical and non-technical audiences
Proven capability to build scripts, automated workflows, or AI-enabled tooling that minimizes manual GRC and risk labor
Ability to navigate ambiguity, handle multiple simultaneous assessments, and adapt to tight deadlines
Strong verbal and written communication skills focused on translating security concepts into business risk

Qualifications

Familiarity with AI governance frameworks like ISO 42001 or NIST AI RMF
Understanding of cloud security, SaaS security models, and DevSecOps practices
Relevant professional certifications such as CISSP, CISM, CISA, or CRISC

Core Skills

Git Communication Leadership Sales Recruitment

Benefits

Flexible paid time off
Participation in team member resource groups
Equity compensation and employee stock purchase plan
Growth and development fund
Parental leave

Frequently Asked Questions

Answers are based only on the employer’s listing; where it doesn’t say, neither do we.

Is this position remote?

Yes, this role is fully remote, though some positions may carry specific location-based eligibility requirements determined during the recruiting process.

What is the employment type?

This is a full-time position.

What salary does this role offer?

The base salary range for United States residents is $139,200 to $189,000 USD, though exact placement depends on factors like education, experience, market data, and geographic location. Salaries for locations outside the US are not specified in the posting.

What is required to apply?

Applicants need 5+ years of security risk management experience using frameworks like NIST RMF or ISO 31000, expertise in qualitative and quantitative risk analysis, a track record of driving cross-functional remediation, and a demonstrated ability to build automation scripts or AI tools for GRC workflows.