# Senior Security Risk Engineer **Company**: GitLab **Location**: Remote, Canada; Remote, United States **Work arrangement**: remote **Experience**: senior **Job type**: full-time **Salary**: $139,200-$189,000 USD **Category**: IT **Industry**: Technology **Apply**: https://job-boards.greenhouse.io/gitlab/jobs/8846304002?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply **Canonical**: https://yubhub.co/jobs/job_da2a8afe-523 ## Description GitLab's Security Risk function is responsible for reducing risk across the security division, including third-party risk, annual security risk assessments, quarterly risk reporting, and remediation of security findings. As a Senior Security Risk Engineer, you'll take ownership of risk identification, quantification, and remediation tracking across the business, and you'll be a driving force behind automating and modernizing how the team does this work using AI and scripting. **Responsibilities:** - Own risk identification, analysis, and prioritization across third-party risk, security risk assessments, and security findings, using an established risk framework. - Translate technical vulnerabilities, control gaps, and risk findings into clear, quantified risk statements that non-security stakeholders and leadership can act on. - Drive remediation of findings and risk exceptions to closure, partnering with Engineering, IT, Product, and Legal, and escalating stalled or high-severity items. - Mature and maintain a risk register and quarterly reporting cadence that gives leadership clear visibility into open risk, remediation progress, and trends. - Own and mature AI risk management, including AI impact assessments, AI risk assessments, and risk treatments, to support ISO 42001 certification. - Design, develop, and implement key risk indicators and supporting metrics for top risks in the risk register. - Identify manual, repetitive steps in risk and TPRM workflows and personally build the automation, scripting, or AI-enabled tooling to remove them. - Contribute to the roadmap for the risk program, incorporating new frameworks, regulatory changes, and lessons learned from past assessments. - Monitor the internal and external risk landscape to identify and escalate emerging risks before they become findings. **Requirements:** - 5+ years of experience in security risk management, working with security-centric risk management or compliance frameworks. - Experience designing and executing qualitative and quantitative risk analyses that translate technical risks into measurable business impact. - A track record of driving risk assessments, risk registers, and remediation efforts to closure across IT, Procurement, Internal Audit, Legal, Product, and Engineering, in a heavily regulated or multi-entity environment. - Experience interpreting technical control requirements and translating them for both technical and non-technical stakeholders. - Demonstrated bias toward automation: you've personally built scripts, workflows, or AI-enabled tooling that reduced manual risk or GRC work. - Comfort operating with ambiguity, managing multiple concurrent assessments, and reprioritizing under tight deadlines. - Exceptional written and verbal communication skills with demonstrated ability to translate security risks into business risks. - Strong understanding of cloud security, SaaS security models, and DevSecOps practices. **Benefits:** - Benefits to support your health, finances, and well-being - Flexible Paid Time Off - Team Member Resource Groups - Equity Compensation & Employee Stock Purchase Plan - Growth and Development Fund - Parental Leave ## Skills ### Required - security risk management - compliance frameworks - risk analysis - automation - scripting - AI - cloud security - SaaS security models - DevSecOps ### Nice to have - AI governance frameworks - ISO 42001 - NIST AI RMF - CISSP - CISM - CISA - CRISC --- Source: [Apply at job-boards.greenhouse.io](https://job-boards.greenhouse.io/gitlab/jobs/8846304002?utm_source=yubhub.co&utm_medium=jobs_feed&utm_campaign=apply)