Senior Security Compliance Engineer, Public Sector

GitLab is seeking a highly skilled and experienced Senior Security Compliance Engineer to support the Public Sector Compliance team. The ideal candidate will have a robust background in cybersecurity and compliance, with a proven track record of supporting highly regulated customers in the U.S. and international public sector.

Job Overview As a Senior Security Compliance Engineer, you will advance customer trust and execute the Public Sector Compliance roadmap to achieve results for customers. This role will directly support GitLab Dedicated and GitLab Dedicated for Government SaaS offerings, as well as mature GitLab's compliance posture across self-managed offerings and GitLab Inc. as a whole.

Responsibilities

• Develop, implement, and manage GRC strategies and processes to support compliance with various regulatory and industry standards, including FedRAMP, IRAP, and others.
• Work closely with highly regulated customers to understand their unique compliance requirements and provide tailored solutions.
• Lead and manage security assessments, audits, and certification processes.
• Support GitLab Dedicated for Government's ongoing FedRAMP continuous monitoring commitments.
• Collaborate with cross-functional teams to integrate GRC requirements into the organization's operations and technology stack.
• Develop and maintain comprehensive documentation to support compliance initiatives.
• Utilize scripting/coding skills to automate GRC processes and implement compliance-as-code or policy-as-code solutions.
• Monitor and analyze regulatory changes and industry trends to ensure continuous improvement of the GRC program.
• Provide training and guidance to internal teams and customers on GRC-related topics.
• Act as a subject matter expert on GRC issues, providing strategic advice and support to senior management and stakeholders.

Requirements

• Valid proof of US citizenship and residency.
• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or equivalent experience.
• Minimum of 5 years of experience in GRC, cybersecurity, or a related field, with a focus on highly regulated industries.
• Proven experience achieving and maintaining security certifications such as FedRAMP, CMMC, SOC 2, IRAP, ISO 27001, and others.
• Strong understanding of regulatory and compliance requirements for the public sector and highly regulated verticals.
• Familiarity with implementing compliance-as-code or policy-as-code, and automating control testing and evidence collection.
• Basic knowledge of FedRAMP requirements, processes, and documentation.
• Familiarity with cloud hyperscalers services and how they work (e.g., AWS, GCP).
• Excellent analytical, problem-solving, and project management skills.
• Strong communication and interpersonal skills.
• Relevant certifications such as CISSP, CISM, CISA, or similar are highly desirable.

Benefits

• Benefits to support your health, finances, and well-being.
• Flexible Paid Time Off.
• Team Member Resource Groups.
• Equity Compensation & Employee Stock Purchase Plan.
• Growth and Development Fund.
• Parental Leave.