Remote opportunity at
GitLabStaff Security Governance Engineer, Policies & Standards
GitLab is seeking a remote Staff Security Governance Engineer to oversee the complete lifecycle of its security policies, standards, guidelines, and procedures. GitLab operates as an…
Career Tools
About This Role
GitLab is seeking a remote Staff Security Governance Engineer to oversee the complete lifecycle of its security policies, standards, guidelines, and procedures. GitLab operates as an intelligent orchestration platform for DevSecOps, helping organizations boost developer productivity, enhance operational efficiency, and lower security and compliance risks. More than half of Fortune 100 companies and over 50 million registered users rely on GitLab to build secure software efficiently. In this individual contributor…
Job Description
GitLab is seeking a remote Staff Security Governance Engineer to oversee the complete lifecycle of its security policies, standards, guidelines, and procedures. GitLab operates as an intelligent orchestration platform for DevSecOps, helping organizations boost developer productivity, enhance operational efficiency, and lower security and compliance risks. More than half of Fortune 100 companies and over 50 million registered users rely on GitLab to build secure software efficiently.
In this individual contributor role sitting on the Security Governance team within Security Assurance, you will report directly to the Director of Customer Trust & Security Governance. You will translate evolving regulatory standards—such as artificial intelligence rules—into actionable guidelines for product, engineering, and legal departments. The position suits an experienced security professional who values asynchronous work and wants to implement automation and AI-assisted workflows to keep governance continuous and streamlined. Key responsibilities include managing exception processes, handling policy attestation, maintaining regulatory mappings, tracking adherence key performance indicators, assisting with audits, and engaging in customer trust initiatives.
Responsibilities
- Manage the complete lifecycle of security policies, standards, procedures, and guidelines from drafting through retirement.
- Run exception management processes involving risk-based approvals, expiration tracking, and trend analysis.
- Conduct policy attestation and investigate instances of non-adherence.
- Monitor emerging regulations and frameworks such as the EU AI Act, NIST AI RMF, ISO 42001, and sector-specific rules.
- Maintain mapping documents between security policies and frameworks including SOC 2, ISO 27001, FedRAMP, and NIST CSF.
- Establish key performance indicators for policy adherence and report metrics to security leadership.
- Coordinate evidence collection, testing, and remediation management for audits.
- Handle customer questionnaires and meetings while converting recurring client requests into scalable policies.
- Collaborate with GRC Engineering to deploy automation and artificial intelligence for policy management and control monitoring.
- Guide cross-functional stakeholders across Security, Product, Legal, and Engineering without direct authority.
Requirements
- Ten or more years of professional experience in information technology risk, governance, risk, and compliance, or security governance.
- Hands-on ownership history of a policy and standards lifecycle with tangible outcomes at a global technology organization.
- Practical working knowledge of SOC 2, ISO 27001, ISO 42001, FedRAMP, and NIST CSF frameworks.
- Familiarity with cloud computing, SaaS operations, and DevSecOps environments.
- Demonstrated application of automation or artificial intelligence to minimize manual governance workload.
- Strong verbal and written communication skills suitable for technical translation to engineers, executives, auditors, and clients.
Qualifications
- Professional certifications such as CISSP, CISM, CISA, or equivalent credentials.
Core Skills
Benefits
- Flexible paid time off
- Team member resource groups
- Equity compensation and employee stock purchase plan
- Growth and development fund
- Parental leave
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is this position remote?
Yes, this role is remote, though certain locations may carry specific location-based eligibility requirements.
What is the employment type?
This is a full-time position.
What salary does this role offer?
The base salary range for United States residents is $168,000 to $238,000 USD, determined by experience, market data, and location. Salaries for other regions are not specified.
How many years of experience are required?
The posting requires 10 or more years of experience in security governance, GRC, or IT risk.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.