Principal Security Engineer - Field Assurance & Legal NEW

The Briefed; United States; Remote; USD 203,000 - 285,000; Full time

Benefits offered by this job

Remote work

Equity compensation

Healthcare benefits

ESPP

Job summary

The Briefed is seeking a Principal Field Security Engineer to serve as the primary security advisor for enterprise customers, field teams, and legal counsel. This remote role focuses on trust-building, reviewing security contracts, and translating regulatory requirements into actionable security programs.

You will maintain the Trust Center, support governance initiatives, and contribute to security content and roadmaps.

Qualifications

• 10+ years of professional experience in information security, with at least 5 years in dedicated customer-facing or field security roles.
• Deep expertise in global security standards and frameworks (SOC 2, ISO 27001/27017/27018/42001, FedRAMP, NIST CSF).
• Strong understanding of regulatory and privacy frameworks affecting enterprise SaaS (GDPR, CCPA, DORA, EU AI Act).
• Proven track record in contract negotiation and security/privacy terms within enterprise software agreements.
• Deep understanding of cloud security, SaaS hosting models, container security, and DevSecOps pipelines.

Responsibilities

• Serve as the primary security point of contact for enterprise clients and prospects; explain GitLab’s security controls, privacy safeguards, and architectural compliance.
• Perform in-depth reviews of customer and vendor agreements, analyze security/privacy clauses, and partner with Legal to negotiate terms.
• Build templates, playbooks, and training to accelerate field negotiations and manage escalations via the Customer Assurance Service Desk.
• Author high-impact security content (whitepapers, blogs, standards) and represent GitLab’s security posture at industry events.
• Maintain and enhance GitLab’s Trust Center and inform Product/Security roadmaps through QBRs, mentoring team members.

Skills

Information security

Customer-facing experience

Cloud security

DevSecOps

Written communication

Job description

GitLab is the intelligent orchestration platform for DevSecOps, trusted by over 50 million registered users and more than 50% of the Fortune 100 to ship software faster and more securely.

The Security Assurance organization builds and maintains trust by strengthening how GitLab approaches security, compliance, and risk. Sitting within the Security Governance team, the Principal Field Security Engineer acts as the primary technical security advisor for enterprise customers, field sales teams, and legal counsel. In this high-visibility, remote role, you will lead complex customer security assurances, review and negotiate security/privacy contractual clauses, maintain GitLab’s Trust Center, and translate regulatory frameworks (SOC 2, ISO 27001/42001, FedRAMP, NIST CSF, GDPR, DORA, EU AI Act) into actionable business solutions that drive revenue growth.

Key Responsibilities

• Customer Engagement & Security Assurance: Serve as the primary security point of contact for enterprise clients and prospects; participate in customer meetings to explain GitLab’s DevSecOps security controls, privacy safeguards, and architectural compliance.
• Contract & Legal Security Review: Perform in-depth reviews of customer and vendor agreements, analyze security/privacy clauses, provide risk-based remediation options, and partner with Legal and Procurement teams to negotiate complex contractual terms.
• Field Enablement & Escalations: Build templates, playbooks, fallback positions, and training to accelerate field negotiations; resolve escalations for complex security questionnaires, RFPs, and risk assessments via the Customer Assurance Service Desk.
• Security Thought Leadership & Content: Author high-impact security content (whitepapers, blog posts, technical standards, sales enablement materials) and represent GitLab's security posture at industry events.
• Strategic Governance Initiatives: Maintain and enhance GitLab’s Trust Center, inform Product and Security roadmaps through Quarterly Business Reviews (QBRs), and mentor Security Assurance team members.

Requirements

Information Security & Customer-Facing Expertise

• 10+ years of professional experience in information security, with at least 5 years in dedicated customer-facing or field security roles.
• Compliance & Security Framework Mastery: Deep expertise in global security standards and frameworks, including SOC 2, ISO 27001 / 27017 / 27018 / 42001, FedRAMP, and NIST CSF.
• Regulatory & Privacy Knowledge: Strong understanding of legal frameworks affecting enterprise SaaS, including GDPR, CCPA, DORA, and the EU AI Act.
• Contract Negotiation & Legal Review: Proven track record analyzing and negotiating security, privacy, and data protection terms within enterprise software agreements.
• Cloud & DevSecOps Architecture: Deep understanding of modern cloud security, SaaS hosting models, container security, and DevSecOps continuous delivery pipelines.
• Asynchronous Communication: Exceptional written and verbal communication skills to write policies in the open and present technical risk clearly to non-technical stakeholders.

Preferred Qualifications

• Industry certifications: CISSP, CISA, CISM, CCSP, ISO 27001 Lead Implementer/Auditor, CIPP, or CIPM (or equivalent demonstrated experience).
• Track record of speaking at security conferences (e.g., RSA, BSides, AWS re:Inforce).
• Experience evaluating AI governance risk and AI compliance controls under ISO 42001 or the EU AI Act.

Total Rewards & Benefits

• Compensation & Equity: US base salary range of $203,200 – $285,000 USD + equity compensation package + Employee Stock Purchase Plan (ESPP).
• Flexibility & Remote Culture: All-remote, asynchronous work culture with Flexible Paid Time Off (PTO) and paid parental leave.
• Professional Growth: Dedicated Growth and Development Fund for continuous education, industry certifications, and event attendance.
• Well-Being & Support: Team Member Resource Groups (TMRGs), comprehensive healthcare benefits, and home office stipends.