Note: The job is a remote job and is open to candidates in USA. GitLab is an intelligent orchestration platform for DevSecOps. The company is seeking a Senior Security Compliance Engineer to support its Public Sector Compliance team, advance customer trust, and execute the compliance roadmap for GitLab’s government and self-managed offerings. The role focuses on GRC strategy, regulated-customer compliance, security assessments, certification processes, continuous monitoring, documentation, and compliance automation.
Responsibilities
- Develop, implement, and manage GRC strategies and processes to support compliance with various regulatory and industry standards, including FedRAMP, IRAP, and others
- Work closely with highly regulated customers to understand their unique compliance requirements and provide tailored solutions to ensure adherence to relevant frameworks and certifications
- Lead and manage security assessments, audits, and certification processes, ensuring timely and successful completion
- Support GitLab Dedicated for Government’s ongoing FedRAMP continuous monitoring commitments
- Collaborate with cross-functional teams, including IT, Product, Engineering, Security, and Legal, to integrate GRC requirements into the organization's operations and technology stack
- Develop and maintain comprehensive documentation, including policies, procedures, and controls, to support compliance initiatives
- Utilize scripting/coding skills to automate GRC processes and implement compliance-as-code or policy-as-code solutions
- Monitor and analyze regulatory changes and industry trends to ensure continuous improvement of the GRC program and maintain up-to-date compliance
- Provide training and guidance to internal teams and customers on GRC-related topics, fostering a culture of compliance and security awareness
- Act as a subject matter expert on GRC issues, providing strategic advice and support to senior management and stakeholders
Skills
- The candidate should have a robust background in cybersecurity and compliance, with a proven track record of supporting highly regulated customers in the U.S. and international public sector, as well as other highly regulated verticals
- The candidate should have hands-on experience achieving and maintaining security certifications such as FedRAMP, CMMC, IRAP, SOC2 and ISO 27001, or similar
- Additionally, familiarity with Governance, Risk, and Compliance (GRC) engineering and implementing compliance-as-code / policy-as-code is essential
- Due to government requirements, you must be a United States Citizen (defined as any individual who is a citizen of the United States by law, birth, or naturalization) to fill this position, and you must be based in the United States
- Valid proof of US citizenship and residency
- Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or equivalent experience in a related field
- Minimum of 5 years of experience in GRC, cybersecurity, or a related field, with a focus on highly regulated industries
- Proven experience achieving and maintaining security certifications such as FedRAMP, CMMC, SOC 2, IRAP, ISO 27001, and others
- Strong understanding of regulatory and compliance requirements for the public sector and highly regulated verticals
- Familiarity with implementing compliance-as-code or policy-as-code, and automating control testing and evidence collection
- Basic knowledge of FedRAMP requirements, processes, and documentation
- Familiarity with cloud hyperscalers services and how they work (e.g. AWS, GCP, etc.)
- Excellent analytical, problem-solving, and project management skills
- Strong communication and interpersonal skills, with the ability to effectively collaborate with internal teams, auditors, customers, and regulatory bodies
- Ability to work independently and manage multiple projects simultaneously in a fast-paced environment
- Relevant certifications such as CISSP, CISM, CISA, or similar are highly desirable
Benefits
- Benefits to support your health, finances, and well-being
- Flexible Paid Time Off
- Team Member Resource Groups
- Equity Compensation & Employee Stock Purchase Plan
- Growth and Development Fund
- Parental Leave
Company Overview