Principal Security Engineer - Field Assurance & Legal

GitLab is the intelligent orchestration platform for DevSecOps, trusted by over 50 million registered users and more than 50% of the Fortune 100 to ship software faster and more securely.

The Security Assurance organization builds and maintains trust by strengthening how GitLab approaches security, compliance, and risk. Sitting within the Security Governance team, the Principal Field Security Engineer acts as the primary technical security advisor for enterprise customers, field sales teams, and legal counsel. In this high-visibility, remote role, you will lead complex customer security assurances, review and negotiate security/privacy contractual clauses, maintain GitLab’s Trust Center, and translate regulatory frameworks (SOC 2, ISO 27001/42001, FedRAMP, NIST CSF, GDPR, DORA, EU AI Act) into actionable business solutions that drive revenue growth.

Key Responsibilities

• Customer Engagement & Security Assurance: Serve as the primary security point of contact for enterprise clients and prospects; participate in customer meetings to explain GitLab’s DevSecOps security controls, privacy safeguards, and architectural compliance.
• Contract & Legal Security Review: Perform in-depth reviews of customer and vendor agreements, analyze security/privacy clauses, provide risk-based remediation options, and partner with Legal and Procurement teams to negotiate complex contractual terms.
• Field Enablement & Escalations: Build templates, playbooks, fallback positions, and training to accelerate field negotiations; resolve escalations for complex security questionnaires, RFPs, and risk assessments via the Customer Assurance Service Desk.
• Security Thought Leadership & Content: Author high-impact security content (whitepapers, blog posts, technical standards, sales enablement materials) and represent GitLab's security posture at industry events.
• Strategic Governance Initiatives: Maintain and enhance GitLab’s Trust Center, inform Product and Security roadmaps through Quarterly Business Reviews (QBRs), and mentor Security Assurance team members.

Requirements

Information Security & Customer-Facing Expertise

• 10+ years of professional experience in information security, with at least 5 years in dedicated customer-facing or field security roles.
• Compliance & Security Framework Mastery: Deep expertise in global security standards and frameworks, including SOC 2, ISO 27001 / 27017 / 27018 / 42001, FedRAMP, and NIST CSF.
• Regulatory & Privacy Knowledge: Strong understanding of legal frameworks affecting enterprise SaaS, including GDPR, CCPA, DORA, and the EU AI Act.
• Contract Negotiation & Legal Review: Proven track record analyzing and negotiating security, privacy, and data protection terms within enterprise software agreements.
• Cloud & DevSecOps Architecture: Deep understanding of modern cloud security, SaaS hosting models, container security, and DevSecOps continuous delivery pipelines.
• Asynchronous Communication: Exceptional written and verbal communication skills to write policies in the open and present technical risk clearly to non-technical stakeholders.

Preferred Qualifications

• Industry certifications: CISSP, CISA, CISM, CCSP, ISO 27001 Lead Implementer/Auditor, CIPP, or CIPM (or equivalent demonstrated experience).
• Track record of speaking at security conferences (e.g., RSA, BSides, AWS re:Inforce).
• Experience evaluating AI governance risk and AI compliance controls under ISO 42001 or the EU AI Act.

Total Rewards & Benefits

• Compensation & Equity: US base salary range of $203,200 – $285,000 USD + equity compensation package + Employee Stock Purchase Plan (ESPP).
• Flexibility & Remote Culture: All-remote, asynchronous work culture with Flexible Paid Time Off (PTO) and paid parental leave.
• Professional Growth: Dedicated Growth and Development Fund for continuous education, industry certifications, and event attendance.
• Well-Being & Support: Team Member Resource Groups (TMRGs), comprehensive healthcare benefits, and home office stipends.