GitLab is an open core software company that develops the most comprehensive DevSecOps Platform used by more than 100,000 organizations. Our mission makes it clear that we believe in a world where everyone can contribute. We make that possible at GitLab by running our operations on our product and staying aligned with our values. Learn more about Life at GitLab.
An overview of this role
We are seeking a detail-oriented and experienced Security Compliance Engineer to lead our FedRAMP compliance efforts. The ideal candidate will have a strong background in cybersecurity and compliance, with specific expertise in achieving and maintaining security certifications like FedRAMP. This role will be critical in ensuring our cloud services meet the stringent security requirements set by the Federal Risk and Authorization Management Program (FedRAMP).
Want more jobs like this?
Get Science and Engineering jobs that are Remote delivered to your inbox every week.
As an Intermediate Security Compliance Engineer, it will be your goal to advance customer trust and execute the security compliance roadmap to achieve results for customers. This role will be directly supporting the GitLab Dedicated for Government SaaS offering, FIPS-compliant software releases, as well as maturing GitLab’s compliance posture across our self-managed offerings and GitLab Inc. as a whole.
Relevant Links:
What you’ll do
- Support the development, implementation, and management of our FedRAMP compliance program, ensuring all cloud services meet or exceed FedRAMP requirements.
- Coordinate and manage the entire FedRAMP lifecycle, including initial assessment, authorization, continuous monitoring, and reauthorization processes.
- Work closely with internal teams, including IT, security, and development, to integrate FedRAMP requirements into the organization’s operations and technology stack.
- Develop and maintain comprehensive documentation, including System Security Plans (SSP), policies, procedures, and controls, to support FedRAMP compliance initiatives.
- Automate and maintain the plan of action & milestones (POA&M) and other continuous monitoring requirements.
- Conduct regular security assessments and audits to ensure continuous compliance with FedRAMP and other relevant standards.
- Monitor and analyze changes in FedRAMP requirements and guidelines, ensuring the organization remains compliant with the latest updates.
- Provide training and guidance to internal teams on FedRAMP-related topics, fostering a culture of compliance and security awareness.
- Act as the primary point of contact for FedRAMP-related inquiries and coordination with external auditors and assessors.
- Prepare and present compliance reports to senior management and stakeholders, highlighting the status of FedRAMP initiatives and any areas requiring attention.
What you’ll bring:
- Proof of U.S. citizenship and residency.
- Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field; or equivalent experience in a related field.
- Minimum of 3 years of experience in security compliance or governance, risk, and compliance (GRC), preferably supporting U.S. public sector security authorizations.
- The candidate must be a U.S. citizen located within the continental U.S.
- Knowledge of FedRAMP, CMMC, NIST 800-53, NIST RMF, FISMA, or similar.
- Familiarity with cloud hyperscalers services and how they work (e.g. AWS, GCP, etc.).
- Excellent analytical, problem-solving, and project management skills.
- Strong communication and interpersonal skills, with the ability to effectively collaborate with internal teams, auditors, customers, and regulatory bodies.
- Relevant certifications such as CISSP, CISM, CISA, or similar are highly desirable.
- Ability to work independently and manage multiple projects simultaneously in a fast-paced environment.
About the team
The Security Compliance (Dedicated Markets) team works very closely with the Security Compliance (Commercial) team and is part of the Security Assurance department within the Security division. This team enables results for customers by ensuring compliance is a sales enabler. We work cross-functionally within Security and have strong relationships with Product, Engineering, and Sales.
How GitLab will support you
- Benefits to support your health, finances, and well-being
- All remote, asynchronous work environment
- Flexible Paid Time Off
- Team Member Resource Groups
- Equity Compensation & Employee Stock Purchase Plan
- Growth and development budget
- Parental leave
- Home office support
Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement. Additionally, studies have shown that people from underrepresented groups are less likely to apply to a job unless they meet every single qualification. If you're excited about this role, please apply and allow our recruiters to assess your application.
#LI-JM1
The base salary range for this role’s listed level is currently for residents of listed locations only. Grade level and salary ranges are determined through interviews and a review of education, experience, knowledge, skills, abilities of the applicant, equity with other team members, and alignment with market data. See more information on our benefits and equity. Sales roles are also eligible for incentive pay targeted at up to 100% of the offered base salary.
Country Hiring Guidelines: GitLab hires new team members in countries around the world. All of our roles are remote, however some roles may carry specific location-based eligibility requirements. Our Talent Acquisition team can help answer any questions about location after starting the recruiting process.
Privacy Policy: Please review our Recruitment Privacy Policy. Your privacy is important to us.
GitLab is proud to be an equal opportunity workplace and is an affirmative action employer. GitLab’s policies and practices relating to recruitment, employment, career development and advancement, promotion, and retirement are based solely on merit, regardless of race, color, religion, ancestry, sex (including pregnancy, lactation, sexual orientation, gender identity, or gender expression), national origin, age, citizenship, marital status, mental or physical disability, genetic information (including family medical history), discharge status from the military, protected veteran status (which includes disabled veterans, recently separated veterans, active duty wartime or campaign badge veterans, and Armed Forces service medal veterans), or any other basis protected by law. GitLab will not tolerate discrimination or harassment based on any of these characteristics. See also GitLab’s EEO Policy and EEO is the Law. If you have a disability or special need that requires accommodation, please let us know during the recruiting process.