Senior Security Risk Engineer

Owns risk identification, quantification and remediation tracking in GitLab's Security Risk team, part of Security Assurance, and reports to the Security Risk Manager. The team handles third-party risk, annual security risk assessments, quarterly reporting and the closing out of security findings.

The engineer turns technical vulnerabilities, control gaps and vendor issues into quantified business risk statements, maintains the risk register and key risk indicators, chases fixes to closure across engineering and other teams, and leads AI risk management towards ISO 42001 certification. A large part of the job is personally scripting and building AI tooling to remove manual GRC work. GitLab wants five or more years in security risk management using frameworks such as NIST RMF or ISO 31000; CISSP, CISM, CISA or CRISC is preferred.