Principal Security Awareness & Human Risk Engineer

GitLab is an intelligent orchestration platform for DevSecOps that helps organizations improve productivity, operational efficiency, security, compliance, and digital transformation. The Principal Security Awareness & Human Risk Engineer will own the global security awareness and education program, lead phishing simulations, drive behavior change, manage vendors and platforms, and measure reductions in human-related security risk.

Responsibilities:

• Own and evolve the global security awareness and education program, spanning annual, new-hire, role-based, targeted, executive, and microlearning content
• Lead the phishing simulation program end to end — design, deployment, analysis, and targeted follow-up
• Apply behavior change principles to reinforce secure habits and address priority risk behaviors
• Build and sustain security culture through learning campaigns, Security Awareness Month, and ongoing engagement
• Produce multimedia awareness and education content, including video
• Administer the training and phishing platforms, owning program data and reporting end to end
• Define and report performance indicators to Security Assurance leadership
• Own vendor relationships for phishing, secure coding (OWASP) training, and video production
• Lead market and competitor evaluations, renewal decisions, and cost negotiation, recommending in-house builds where commercial options underperform
• Collaborate on and maintain security policies, standards, and procedures
• Coordinate audit evidence and demonstrate control effectiveness
• Track remediation of identified gaps to closure

Requirements:

• A minimum of 10 years' experience building or scaling global awareness and human-risk programs in a large, globally distributed enterprise, with measurable outcomes
• SANS Security Awareness Professional (SSAP) certification, or equivalent demonstrated expertise in building, maintaining, and measuring a mature awareness program
• Demonstrated experience running enterprise-scale phishing programs and organization-wide awareness campaigns
• Track record of evaluating, selecting, consolidating, or replacing security training vendors, including cost and value analysis
• Instructional design capability
• Working knowledge of security policy development, audit support, and control evidence
• Ability to influence enterprise strategy across technical and non-technical teams without formal authority
• Ability to make complex security topics practical and engaging in an all-remote organization
• Track record of onboarding, managing, and negotiating with third party vendors
• regulated-industry experience preferred