Principal Field Security Engineer (US)

Details

GitLab is seeking an experienced Principal Field Security Engineer to address complex customer security challenges at the intersection of technical architecture and business requirements. The role applies deep security expertise to answer technical questions, assess contract requirements, and enable GitLab’s Sales and field organizations to address enterprise customer security problems. The position works directly with customers and internal teams to provide technical guidance, create security content, and explain how GitLab’s security controls meet compliance and risk-management needs.

Responsibilities

Customer Engagement and Assurance

• Serve as the primary security point of contact for enterprise customer questions, requests, and concerns.
• Join customer and prospect meetings to provide expert guidance on GitLab’s security practices and controls addressing security, privacy, and compliance requirements.
• Build and maintain templates, playbooks, fallback positions, and training to simplify and accelerate negotiations.
• Facilitate customer assurance activities through the Customer Assurance Activities Service Desk.
• Provide escalation support for complex security questionnaires, RFPs, and risk assessments.

Contract and Legal Review

• Perform comprehensive contract reviews for customer agreements and vendor relationships.
• Analyze security and compliance clauses in legal documents.
• Provide risk-based recommendations and remediation guidance for contractual security requirements.
• Partner with Legal, Sales, Product, and Procurement teams to negotiate security-related contract terms.
• Manage escalations, collaborate across teams, and develop solutions that enable business partners to close deals.
• Document and track contract-related security obligations.

Security Evangelism and Thought Leadership

• Develop internal and external security content, including blog posts, whitepapers, technical standards, and field sales enablement training materials.
• Monitor the evolving regulatory landscape affecting agreements.
• Identify, track, and facilitate solutions for security-related customer trends and improvement areas.
• Build and strengthen GitLab’s security brand within the industry.

Strategic Initiatives

• Maintain and enhance GitLab’s Trust Center and self-service security resources.
• Provide strategic recommendations based on customer security concerns in support of revenue growth.
• Participate in Quarterly Business Reviews to inform product and security roadmap decisions.
• Mentor and guide Security Assurance team members.
• Drive continuous improvement of Field Security processes and documentation.
• Design and implement solutions that enable Sales-facing teams to discuss security problems and topics with customers.

Requirements

• 10+ years of experience in information security, including at least 5 years in customer-facing security roles.
• Deep expertise in security frameworks and standards such as SOC 2, ISO 27001/27017/27018/42001, FedRAMP, and NIST CSF.
• Expertise in laws and regulations such as GDPR, CCPA, DORA, and the EU AI Act.
• Proven track record of contract negotiation and security/privacy agreement reviews.
• Exceptional written and verbal communication skills, with the ability to translate complex technical concepts for diverse audiences.
• Experience creating security content, including blogs, whitepapers, and presentations.
• Strong understanding of cloud security, SaaS security models, and DevSecOps practices.
• Experience working cross-functionally with Sales, Legal, Product, and Engineering teams.
• Ability to balance security risk with business objectives.
• Experience speaking at conferences is a plus.
• Preferred certifications include CISSP, CISA, CISM, CCSP, ISO 27001 Lead Implementer/Auditor, or CIPP/CIPM. Equivalent demonstrated experience is equally valued.
• Must be a United States citizen due to government requirements.

Team

The Security Assurance organization builds and maintains trust by strengthening GitLab’s approach to security, compliance, and risk. Security Governance owns customer trust, security awareness, policies and standards, and other governance functions. The team’s counterparts include Security Compliance, Security Risk, and GRC Engineering.

The role is part of a small team of four direct reports under the Director. The team works remote-first and asynchronously, documents work openly, and collaborates with Security, Legal, Product, and Engineering on policies and standards.

Benefits

• Benefits supporting health, finances, and well-being.
• Flexible paid time off.
• Team Member Resource Groups.
• Equity compensation and Employee Stock Purchase Plan.
• Growth and Development Fund.
• Parental leave.