Senior Security Compliance Engineer, Public Sector

GitLab is an intelligent orchestration platform for DevSecOps. The company is seeking a Senior Security Compliance Engineer to support its Public Sector Compliance team, advance customer trust, and execute the compliance roadmap for GitLab’s government and self-managed offerings. The role focuses on GRC strategy, regulated-customer compliance, security assessments, certification processes, continuous monitoring, documentation, and compliance automation.

Responsibilities:

• Develop, implement, and manage GRC strategies and processes to support compliance with various regulatory and industry standards, including FedRAMP, IRAP, and others
• Work closely with highly regulated customers to understand their unique compliance requirements and provide tailored solutions to ensure adherence to relevant frameworks and certifications
• Lead and manage security assessments, audits, and certification processes, ensuring timely and successful completion
• Support GitLab Dedicated for Government’s ongoing FedRAMP continuous monitoring commitments
• Collaborate with cross-functional teams, including IT, Product, Engineering, Security, and Legal, to integrate GRC requirements into the organization's operations and technology stack
• Develop and maintain comprehensive documentation, including policies, procedures, and controls, to support compliance initiatives
• Utilize scripting/coding skills to automate GRC processes and implement compliance-as-code or policy-as-code solutions
• Monitor and analyze regulatory changes and industry trends to ensure continuous improvement of the GRC program and maintain up-to-date compliance
• Provide training and guidance to internal teams and customers on GRC-related topics, fostering a culture of compliance and security awareness
• Act as a subject matter expert on GRC issues, providing strategic advice and support to senior management and stakeholders

Requirements:

• The candidate should have a robust background in cybersecurity and compliance, with a proven track record of supporting highly regulated customers in the U.S. and international public sector, as well as other highly regulated verticals
• The candidate should have hands-on experience achieving and maintaining security certifications such as FedRAMP, CMMC, IRAP, SOC2 and ISO 27001, or similar
• Additionally, familiarity with Governance, Risk, and Compliance (GRC) engineering and implementing compliance-as-code / policy-as-code is essential
• Due to government requirements, you must be a United States Citizen (defined as any individual who is a citizen of the United States by law, birth, or naturalization) to fill this position, and you must be based in the United States
• Valid proof of US citizenship and residency
• Bachelor's degree in Computer Science, Information Technology, Cybersecurity, or equivalent experience in a related field
• Minimum of 5 years of experience in GRC, cybersecurity, or a related field, with a focus on highly regulated industries
• Proven experience achieving and maintaining security certifications such as FedRAMP, CMMC, SOC 2, IRAP, ISO 27001, and others
• Strong understanding of regulatory and compliance requirements for the public sector and highly regulated verticals
• Familiarity with implementing compliance-as-code or policy-as-code, and automating control testing and evidence collection
• Basic knowledge of FedRAMP requirements, processes, and documentation
• Familiarity with cloud hyperscalers services and how they work (e.g. AWS, GCP, etc.)
• Excellent analytical, problem-solving, and project management skills
• Strong communication and interpersonal skills, with the ability to effectively collaborate with internal teams, auditors, customers, and regulatory bodies
• Ability to work independently and manage multiple projects simultaneously in a fast-paced environment
• Relevant certifications such as CISSP, CISM, CISA, or similar are highly desirable