Security Compliance Engineer - FedRAMP

An overview of this role

We are seeking a detail-oriented and experienced Security Compliance Engineer to lead our FedRAMP compliance efforts. The ideal candidate will have a strong background in cybersecurity and compliance with specific expertise in achieving and maintaining security certifications like FedRAMP. This role will be critical in ensuring our cloud services meet the stringent security requirements set by the Federal Risk and Authorization Management Program (FedRAMP).

As an Intermediate Security Compliance Engineer it will be your goal to advance customer trust and execute the security compliance roadmap to achieve results for customers. This role will be directly supporting the GitLab Dedicated for Government SaaS offering FIPS-compliant software releases as well as maturing GitLab’s compliance posture across our self-managed offerings and GitLab Inc. as a whole.

Relevant Links:

• Security Compliance (Dedicated Markets) Team

• GitLab FedRAMP Authorization Program

What you’ll do

• Support the development implementation and management of our FedRAMP compliance program ensuring all cloud services meet or exceed FedRAMP requirements.

• Coordinate and manage the entire FedRAMP lifecycle including initial assessment authorization continuous monitoring and reauthorization processes.

• Work closely with internal teams including IT security and development to integrate FedRAMP requirements into the organization’s operations and technology stack.

• Develop and maintain comprehensive documentation including System Security Plans (SSP) policies procedures and controls to support FedRAMP compliance initiatives.

• Automate and maintain the plan of action & milestones (POA&M) and other continuous monitoring requirements.

• Conduct regular security assessments and audits to ensure continuous compliance with FedRAMP and other relevant standards.

• Monitor and analyze changes in FedRAMP requirements and guidelines ensuring the organization remains compliant with the latest updates.

• Provide training and guidance to internal teams on FedRAMP-related topics fostering a culture of compliance and security awareness.

• Act as the primary point of contact for FedRAMP-related inquiries and coordination with external auditors and assessors.

• Prepare and present compliance reports to senior management and stakeholders highlighting the status of FedRAMP initiatives and any areas requiring attention.

What you’ll bring:

• Proof of U.S. citizenship and residency.

• Bachelor’s degree in Computer Science Information Technology Cybersecurity or a related field; or equivalent experience in a related field.

• Minimum of 3 years of experience in security compliance or governance risk and compliance (GRC) preferably supporting U.S. public sector security authorizations.

• Knowledge of FedRAMP CMMC NIST 800-53 NIST RMF FISMA or similar.

• Familiarity with cloud hyperscalers services and how they work (e.g. AWS GCP etc.).

• Excellent analytical problem-solving and project management skills.

• Strong communication and interpersonal skills with the ability to effectively collaborate with internal teams auditors customers and regulatory bodies.

• Relevant certifications such as CISSP CISM CISA or similar are highly desirable.

• Ability to work independently and manage multiple projects simultaneously in a fast-paced environment.

About the team

The Security Compliance (Dedicated Markets) team works very closely with the Security Compliance (Commercial) team and is part of the Security Assurance department within the Security division. This team enables results for customers by ensuring compliance is a sales enabler. We work cross-functionally within Security and have strong relationships with Product Engineering and Sales.

How GitLab will support you

• Benefits to support your health finances and well-being

• All remote asynchronous work environment

• Flexible Paid Time Off

• Team Member Resource Groups

• Equity Compensation & Employee Stock Purchase Plan

• Growth and development budget

• Parental leave

• Home office support

Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement. Additionally studies have shown that people from underrepresented groups are less likely to apply to a job unless they meet every single qualification. If you're excited about this role please apply and allow our recruiters to assess your application.

#LI-JM1