Senior Security Risk Engineer: AI-Driven Risk & Automation

GitLab; United States; Remote; USD 139,000 - 189,000; Full time

Benefits offered by this job

Flexible Paid Time Off

Equity Compensation & Employee Stock(

Job summary

GitLab is seeking a Senior Security Risk Engineer to own risk identification, quantification, and remediation across third‑party risk and security findings. You will drive automation and AI-enabled tooling to improve risk workflows and partner with Engineering, IT, Product, and Legal.

You will help surface emerging risks, report top risks to leadership, and contribute to the roadmap for risk programs in a heavily regulated, multi‑entity environment.

Qualifications

• 5+ years of experience in security risk management and compliance frameworks (e.g., NIST RMF, ISO 31000).
• Ability to translate technical risk into business impact for non-technical stakeholders.
• Proven track record driving risk assessments, risk registers, and remediation to closure.

Responsibilities

• Own risk identification, analysis, and prioritization across third‑party risk, security risk assessments, and findings.
• Translate technical vulnerabilities into quantified risk statements for leadership action.
• Drive remediation of findings and risk exceptions with cross‑functional teams (Engineering, IT, Product, Legal).
• Mature risk register and quarterly reporting cadence for leadership visibility into open risk and trends.
• Design, implement, and monitor AI risk management activities to support ISO 42001 certification.

Skills

Security risk management

Risk assessment

Automation scripting

Cloud security

DevSecOps

Tools

Python

PowerShell

Cloud platforms

Job description

GitLab is seeking a Senior Security Risk Engineer to own risk identification, quantification, and remediation across third‑party risk and security findings. You will drive automation and AI-enabled tooling to improve risk workflows and partner with Engineering, IT, Product, and Legal.

You will help surface emerging risks, report top risks to leadership, and contribute to the roadmap for risk programs in a heavily regulated, multi‑entity environment.