Senior Security Governance Engineer, Policies & Standards

GitLab Inc.; Northern (KY); Hybrid; USD 170,000 - 230,000; Full time

Job summary

GitLab is seeking a Staff Security Governance Engineer to own how we write, maintain, and measure security policies and standards. You will translate regulations into actionable requirements for engineering, product, and legal teams, and use automation to keep governance lightweight and continuous.

You will work on the Security Governance team within Security Assurance, partnering with Legal, Security Compliance, and GRC Engineering to drive policy program maturity and customer trust.

Qualifications

• 10+ years in security governance, GRC, or IT risk with policy lifecycle ownership.
• Knowledge of SOC 2, ISO 27001, ISO 42001, FedRAMP, and NIST CSF.
• Understanding of cloud, SaaS, and DevSecOps practices.
• Risk-based mindset balancing compliance with real security risk.
• Experience with automation or AI to reduce manual GRC work.
• Strong written and verbal communication for engineers, executives, auditors, and customers.
• Experience collaborating with Security, Product, Legal, and Engineering.
• Certifications such as CISSP, CISM, CISA desirable.

Responsibilities

• Own end-to-end lifecycle of GitLab's security policies, standards, procedures, and guidelines.
• Define and run the exception management process with risk-based approvals, expiry tracking, and trend reporting.
• Run policy attestation and investigate non-adherence.
• Keep policies clear, practical, and aligned with DevSecOps workflows.
• Monitor emerging regulations and standards and coordinate with Legal ahead of deadlines.
• Maintain mappings to SOC 2, ISO 27001/27017/27018/42001, FedRAMP, and NIST CSF.
• Define KPIs for policy adherence and report trends to Security leadership.
• Support audit activities with evidence, testing, and remediation management.
• Mentor team members and contribute to the governance roadmap.

Skills

Security governance

Regulatory frameworks

Cloud & DevSecOps

Risk-based mindset

Automation/AI in GRC

Technical writing

Cross-functional collaboration

Security certifications desirable

Education

Security certifications

Job description

GitLab is seeking a Staff Security Governance Engineer to own how we write, maintain, and measure security policies and standards. You will translate regulations into actionable requirements for engineering, product, and legal teams, and use automation to keep governance lightweight and continuous.

You will work on the Security Governance team within Security Assurance, partnering with Legal, Security Compliance, and GRC Engineering to drive policy program maturity and customer trust.