Staff Security Governance Engineer, Policies & Standards

Overview

Own GitLab's security policies and standards end to end, turning emerging regulation, including AI regulation, into clear requirements that engineering, product, and legal teams can act on. Sits within the Security Governance team in Security Assurance and reports to the Director, Customer Trust & Security Governance.

What you'll do

• Own the end-to-end lifecycle of security policies, standards, procedures, and guidelines: drafting, stakeholder review, approval, publication, annual review, and retirement.
• Define and run the exception management process, including risk-based approvals, expiry tracking, and trend reporting that shows where policies need to change.
• Run policy attestation and investigate non-adherence.
• Keep policies clear, practical, and aligned with how engineering teams work in a DevSecOps environment.
• Monitor emerging regulations and standards (e.g., EU AI Act, NIST AI RMF, ISO 42001, sector or regional requirements) and partner with Legal well ahead of compliance deadlines to assess impact and update policy.
• Maintain mappings between policies and frameworks such as SOC 2, ISO 27001, ISO 42001, FedRAMP, and NIST CSF, so requirements are written once and reused.
• Define KPIs for policy adherence and report trends to Security leadership.
• Run targeted internal assessments of adherence and drive remediation to closure.
• Support audit activities by coordinating evidence, testing, and remediation management.
• Support customer questionnaires and customer meetings, and help turn recurring customer requests into better policies and self-service content.
• Identify and implement automation and AI-assisted workflows for policy management, evidence collection, control monitoring, and assessment work, in partnership with GRC Engineering.
• Act as a technical and program leader across Security, Product, Legal, and Engineering, influencing without direct authority.
• Mentor other team members and help set the direction of the Security Governance roadmap.

What you'll need

• 10+ years in security governance, GRC, or IT risk, with hands-on ownership of a policy and standards lifecycle and measurable outcomes, ideally at a global technology company.
• Working knowledge of SOC 2, ISO 27001, ISO 42001, FedRAMP, and NIST CSF, including how to put them into practice, not only how to read them.
• Experience creating and maintaining an enterprise Information Security Management System (ISMS), ideally including hands-on involvement in ISO 27001 certification or recertification.
• Understanding of cloud, SaaS, and DevSecOps practices, and the ability to write policy that engineers will follow.
• A risk-based mindset that balances compliance with real security risk.
• Demonstrated use of automation or AI to reduce manual GRC work.
• Strong written and verbal communication, including translating technical concepts for engineers, executives, auditors, and customers.
• Experience collaborating with Security, Product, Legal, and Engineering.

Nice to have

• Certifications such as CISSP, CISM, CISA, or similar.

Details

• Location: Remote, United States.
• Base salary range: $168,000 – $238,000 USD (United States residents only; excludes bonuses, equity, and benefits).
• Works remote-first and asynchronously.