Staff Security Governance Engineer, Policies & Standards

Remote · USD 168,000-238,000 · 10+ years experience · Remote · Posted Sep 30, 2026

At a glance

As a Staff Security Governance Engineer, you will own how GitLab writes, maintains, communicates, and measures its security policies and standards.
You will turn emerging regulations, including AI regulation, into clear requirements for engineering, product, and legal teams, using automation to keep governance lightweight and continuous.

Own the end-to-end lifecycle of GitLab's security policies, standards, procedures, and guidelines from drafting through retirement.
Define and run the exception management process, including risk-based approvals, expiry tracking, and trend reporting.
Run policy attestation and investigate non-adherence.
Monitor emerging regulations and standards like the EU AI Act, NIST AI RMF, ISO 42001, and regional requirements, partnering with Legal.
Maintain mappings between policies and frameworks such as SOC 2, ISO 27001, ISO 42001, FedRAMP, and NIST CSF.
Define KPIs for policy adherence and report trends to Security leadership.
Run targeted internal assessments of adherence and drive remediation to closure.
Support audit activities by coordinating evidence, testing, and remediation management.
Support customer questionnaires and meetings, turning recurring requests into better policies and self-service content.
Identify and implement automation and AI-assisted workflows for policy management, evidence collection, control monitoring, and assessment work.

10+ years in security governance, GRC, or IT risk, with hands-on ownership of a policy and standards lifecycle and measurable outcomes.
Working knowledge of SOC 2, ISO 27001, ISO 42001, FedRAMP, and NIST CSF.
Understanding of cloud, SaaS, and DevSecOps practices, and the ability to write policy that engineers will follow.
A risk-based mindset that balances compliance with real security risk.
Demonstrated use of automation or AI to reduce manual GRC work.
Strong written and verbal communication skills.
Experience collaborating with Security, Product, Legal, and Engineering.