Senior Technical Security Program Manager, PSIRT

Applied Plastering Inc; Canada; Remote; CAD 80,000 - 100,000; Full time

Job summary

Join a forward-thinking company as a Senior Technical Security Program Manager, where you'll lead the charge in enhancing product security. This exciting role involves managing security incidents, collaborating with cross-functional teams, and driving operational improvements. You will play a crucial part in protecting customers from security threats while working in a dynamic, inclusive environment. If you have a passion for security and a desire to make a significant impact, this is the perfect opportunity for you to shine and help shape the future of secure software development.

Qualifications

• 5+ years in product security response with hands-on experience.
• Strong collaboration and communication skills required.

Responsibilities

• Manage security vulnerabilities and drive incident response.
• Collaborate with security engineering on complex issues.

Skills

Product Security Incident Response

Collaboration Skills

Effective Communication

Attention to Detail

Project Management

Tools

HackerOne

Bugcrowd

QuickSight

Tableau

PowerBI

Job description

Senior Technical Security Program Manager, PSIRT

GitLab is an open core software company that develops the most comprehensive AI-powered DevSecOps Platform, used by more than 100,000 organizations. Our mission is to enable everyone to contribute to and co-create the software that powers our world. When everyone can contribute, consumers become contributors, significantly accelerating the rate of human progress. This mission is integral to our culture, influencing how we hire, build products, and lead our industry. We make this possible at GitLab by running our operations on our product and staying aligned with our values.

An overview of this role

As a GitLab Product Security Incident Response Team (PSIRT) Technical Program Manager (TPM), you will work with a diverse team to respond to reports of security issues in GitLab products and services to drive technical solutions that strengthen customer defenses. You'll help define new operational runbooks and provide invaluable end-to-end insights regarding security posture and threat landscape. You'll engage with engineers and researchers to advance platform security and protect GitLab customers from security and privacy threats.

Attention to detail, ability to respond effectively to changing workloads and priorities, and staying organized are critical skills required for the role. A sense of curiosity, strong program management experience, and a desire to work as part of a team will make you a strong candidate for this role.

What You’ll Do

• Triage, initial assessment, & issue management of product application and infrastructure vulnerabilities reported to GitLab.
• Manage GitLab’s CNA operations, assigning CVEs as appropriate.
• Collaborate with security engineering partners on issues that require complex technical reproduction.
• Act as the customer advocate in managing security risk, ensuring issues are prioritized and remediated at an appropriate velocity, escalating to senior leadership as appropriate.
• Drive internal and external customer communications in partnership with Legal, Corporate Communications, Customer Success, etc.
• Report on issue trends and business impact, tracking completion of key results.
• Define and implement operational improvements to issue handling.
• Manage Bug Bounty operations and drive bounty program strategy.
• Create simple documentation such as runbooks and procedures to improve quality, efficiency, and transparency.
• Drive cross-functional engineering collaboration to document root cause analysis (RCA), lessons-learned and product incident reviews.

What you’ll bring

Required experience

• 5+ years of experience in product security response (PSIRT) organization, with hands-on experience defining and driving product security incident response processes, tools, techniques, and strategies.
• Familiarity with security response standard practices and terminology such as CVE, CVSS, CWE, OWASP top 10, STRIDE model, etc.
• Strong collaboration skills and ability to work with cross-functional teams.
• Effective verbal and written communication skills; demonstrated ability to communicate in an inclusive manner with a global audience through Technical Writing or similar experience.

Preferred experience

• Experience working with HackerOne or Bugcrowd bounty platforms.
• Experience interacting with security researchers participating in Coordinated Vulnerability Disclosure and/or bug bounty programs.
• Experience generating and analyzing metrics with QuickSight, Tableau, PowerBI, or similar analysis software to measure service and program effectiveness and consistency.
• 5+ years of project management experience and demonstrated knowledge of program management best practices.
• Confidence navigating ambiguity and identifying innovative solutions with minimal direction.
• Strong attention to detail, especially regarding security implications.
• Self-motivated with ability to work independently while collaborating remotely.
• Alignment with GitLab's values of collaboration, results, efficiency, diversity, inclusion & belonging, iteration, and transparency.

Some travel may be required (up to 10%).

About the team

The GitLab Product Security Incident Response Team (PSIRT) is a globally distributed team of engineers that ensures GitLab delivers secure applications customers can trust. The PSIRT acts as a central point of contact for external security researchers reporting vulnerabilities in GitLab’s products and governs policies, processes, and guidelines for addressing security vulnerabilities that may affect GitLab’s in-market and supported products.

Even though we’re a global team, we work together in a cross-regional manner and have automation and processes to facilitate collaboration when resolving incidents, handovers, and general collaboration for project work as well.

Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement. If you're excited about this role, please apply and allow our recruiters to assess your application.

Country Hiring Guidelines: GitLab hires new team members in countries around the world. All of our roles are remote; however, some roles may carry specific location-based eligibility requirements. Our Talent Acquisition team can help answer any questions about location after starting the recruiting process.

GitLab is proud to be an equal opportunity workplace and is an affirmative action employer. GitLab’s policies and practices relating to recruitment, employment, career development and advancement, promotion, and retirement are based solely on merit, regardless of race, color, religion, ancestry, sex (including pregnancy, lactation, sexual orientation, gender identity, or gender expression), national origin, age, citizenship, marital status, mental or physical disability, genetic information (including family medical history), discharge status from the military, protected veteran status, or any other basis protected by law. GitLab will not tolerate discrimination or harassment based on any of these characteristics.