Principal Field Security Engineer

GitLab

3d•$203,200 - $285,000•Remote

About The Position

GitLab is seeking an experienced Principal Field Security Engineer to address complex customer security challenges at the intersection of technical architecture and business requirements. The role applies deep security expertise to answer technical questions, assess contract requirements, and support GitLab’s Sales and field organizations in addressing enterprise customers’ security needs. The engineer works with customers and internal teams to provide guidance, create security content, and explain how GitLab’s security controls support compliance and risk management. The role serves as a primary security contact for enterprise customers and prospects, supports assurance activities and complex questionnaires, RFPs, and risk assessments, and reviews customer and vendor contracts for security and compliance terms. It also develops security thought leadership and sales enablement content, maintains the Trust Center and self-service security resources, advises on customer-driven product and security priorities, mentors Security Assurance team members, and improves Field Security processes and documentation. The position is part of Security Assurance, within Security Governance. The team works remote-first and asynchronously, documents work openly, and collaborates with Security, Legal, Product, and Engineering. The position is remote; GitLab notes that some roles may have location-based eligibility requirements.

Requirements

10 or more years of experience in information security, including at least 5 years in customer-facing security roles.
Deep expertise in security frameworks and standards such as SOC 2, ISO 27001/27017/27018/42001, FedRAMP, and NIST CSF.
Expertise in laws and regulations such as GDPR, CCPA, DORA, and the EU AI Act.
Proven track record of contract negotiation and security/privacy agreement reviews.
Exceptional written and verbal communication skills, including the ability to translate complex technical concepts for diverse audiences.
Experience creating security content such as blogs, whitepapers, and presentations.
Strong understanding of cloud security, SaaS security models, and DevSecOps practices.
Experience working cross-functionally with Sales, Legal, Product, and Engineering teams.
Ability to balance security risk with business objectives.

Nice To Haves

Experience speaking at conferences.
One or more relevant certifications such as CISSP, CISA, CISM, CCSP, ISO 27001 Lead Implementer/Auditor, or CIPP/CIPM; equivalent demonstrated experience is equally valued.

Responsibilities

Serve as the primary security point of contact for enterprise customer questions, requests, and concerns.
Join customer and prospect meetings to provide guidance on GitLab’s security practices and controls, addressing security, privacy, and compliance requirements.
Build and maintain templates, playbooks, fallback positions, and training to simplify and accelerate negotiations.
Facilitate customer assurance activities through the Customer Assurance Activities Service Desk.
Provide escalation support for complex security questionnaires, RFPs, and risk assessments.
Review customer agreements and vendor relationships, including security and compliance clauses in legal documents.
Provide risk-based recommendations and remediation guidance for contractual security requirements.
Partner with Legal, Sales, Product, and Procurement to negotiate security-related contract terms, manage escalations, and develop solutions that enable business partners to close deals.
Document and track contract-related security obligations.
Develop internal and external security content, including blog posts, whitepapers, technical standards, and field sales enablement training materials.
Monitor the evolving regulatory landscape affecting agreements and identify, track, and facilitate solutions for customer security trends and improvement areas.
Build and strengthen GitLab’s security brand within the industry.
Maintain and enhance GitLab’s Trust Center and self-service security resources.
Provide strategic recommendations based on customer security concerns in support of revenue growth.
Participate in Quarterly Business Reviews to inform product and security roadmap decisions.
Mentor and provide guidance to Security Assurance team members.
Drive continuous improvement of Field Security processes and documentation.
Design and implement solutions that enable Sales-facing teams to discuss security problems and topics with customers.