Senior Security Compliance Engineer

Who you are

• Valid proof of US citizenship and residency
• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or equivalent experience in a related field
• Minimum of 5 years of experience in GRC, cybersecurity, or a related field, with a focus on highly regulated industries
• Proven experience achieving and maintaining security certifications such as FedRAMP, CMMC, SOC 2, IRAP, ISO 27001, and others
• Strong understanding of regulatory and compliance requirements for the public sector and highly regulated verticals
• Familiarity with implementing compliance-as-code or policy-as-code, and automating control testing and evidence collection
• Basic knowledge of FedRAMP requirements, processes, and documentation
• Familiarity with cloud hyperscalers services and how they work (e.g. AWS, GCP, etc.)
• Excellent analytical, problem-solving, and project management skills
• Strong communication and interpersonal skills, with the ability to effectively collaborate with internal teams, auditors, customers, and regulatory bodies
• Relevant certifications such as CISSP, CISM, CISA, or similar are highly desirable
• Ability to work independently and manage multiple projects simultaneously in a fast-paced environment
• Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement

What the job involves

• We are seeking a highly skilled and experienced Senior Security Compliance Engineer to support the Public Sector Compliance team
• The ideal candidate will have a robust background in cybersecurity and compliance, with a proven track record of supporting highly regulated customers in the U.S. and international public sector, as well as other highly regulated verticals
• The candidate should have hands-on experience achieving and maintaining security certifications such as FedRAMP, CMMC, IRAP, SOC2 and ISO 27001, or similar
• Additionally, familiarity with Governance, Risk, and Compliance (GRC) engineering and implementing compliance-as-code / policy-as-code is essential
• As a Senior Security Compliance Engineer, it will be your goal to advance customer trust and execute the Public Sector Compliance roadmap to achieve results for customers
• This role will be directly supporting the GitLab Dedicated and GitLab Dedicated for Government SaaS offerings, as well as maturing GitLab’s compliance posture across our self-managed offerings and GitLab Inc as a whole
• Develop, implement, and manage GRC strategies and processes to support compliance with various regulatory and industry standards, including FedRAMP, IRAP, and others
• Work closely with highly regulated customers to understand their unique compliance requirements and provide tailored solutions to ensure adherence to relevant frameworks and certifications
• Lead and manage security assessments, audits, and certification processes, ensuring timely and successful completion
• Support GitLab Dedicated for Government’s ongoing FedRAMP continuous monitoring commitments
• Collaborate with cross-functional teams, including IT, Product, Engineering, Security, and Legal, to integrate GRC requirements into the organization's operations and technology stack
• Develop and maintain comprehensive documentation, including policies, procedures, and controls, to support compliance initiatives
• Utilize scripting/coding skills to automate GRC processes and implement compliance-as-code or policy-as-code solutions
• Monitor and analyze regulatory changes and industry trends to ensure continuous improvement of the GRC program and maintain up-to-date compliance
• Provide training and guidance to internal teams and customers on GRC-related topics, fostering a culture of compliance and security awareness
• Act as a subject matter expert on GRC issues, providing strategic advice and support to senior management and stakeholders

Benefits

• We offer benefits to manage your health, wealth, and well-being regardless of location
• Flexibility in schedule to be there for life’s important moments
• Equity compensation & Employee Stock Purchase Plan offered
• Generous Paid Time Off