The opportunity
The Security Assurance organization helps GitLab build and maintain trust by strengthening how we approach security, compliance, and risk across the company. The Security Risk team sits within that group and owns third-party risk (TPRM), security risk assessments, and remediation of security findings.
What you'll do
Own risk identification, analysis, and prioritization across third-party risk: (TPRM), security risk assessments, and security findings, using an established risk framework (e.g., NIST RMF, ISO 31000, or NIST 800-39).
Translate technical vulnerabilities, control gaps, and risk findings into: clear, quantified risk statements that non-security stakeholders and leadership can act on.
Drive remediation of findings and risk exceptions to closure, partnering with: Engineering, IT, Product, and Legal, and escalating stalled or high-severity items.
Mature and maintain a risk register and quarterly reporting cadence that: gives leadership clear visibility into open risk, remediation progress, and trends.
Own and mature AI risk management, including AI impact assessments, AI risk: assessments, and risk treatments, to support ISO 42001 certification.
Design, develop, and implement key risk indicators and supporting metrics for top risks in the risk register.
What they're looking for
- Identify manual, repetitive steps in risk and TPRM workflows and personally: build the automation, scripting, or AI-enabled tooling to remove them.
- Contribute to the roadmap for the risk program, incorporating new frameworks,: regulatory changes, and lessons learned from past assessments.
- Monitor the internal and external risk landscape (new frameworks, threat: trends, business changes) to identify and escalate emerging risks before they become findings.