Principal Field Security Engineer - GitLab

About the Role

GitLab is seeking an experienced Principal Field Security Engineer to tackle complex customer security challenges at the intersection of technical architecture and business requirements. You will apply deep security expertise to answer technical questions, assess contract requirements, and enable GitLab’s Sales and field organizations to address security problems for enterprise customers.

What You'll Do

Customer Engagement & Assurance

• Serve as the primary security point of contact for enterprise customer questions, requests, and concerns.
• Join customer and prospect meetings to provide expert guidance on GitLab’s security practices and controls.
• Build and maintain templates, playbooks, and training to simplify negotiations.
• Facilitate customer assurance activities and provide escalation support for complex security questionnaires, RFPs, and risk assessments.

Contract & Legal Review

• Perform comprehensive contract reviews for customer agreements and vendor relationships.
• Analyze security and compliance clauses in legal documents.
• Provide risk-based recommendations and remediation guidance for contractual security requirements.
• Partner with Legal, Sales, Product, and Procurement teams to negotiate security-related contract terms.

Security Evangelism & Thought Leadership

• Develop internal and external security content such as blog posts, whitepapers, and technical standards.
• Stay current on the evolving regulatory landscape and identify customer security trends.
• Build and strengthen GitLab's security brand within the industry.

Strategic Initiatives

• Maintain and enhance GitLab's Trust Center and self-service security resources.
• Provide strategic recommendations to support revenue growth.
• Participate in Quarterly Business Reviews to inform product and security roadmap decisions.
• Mentor Security Assurance team members and drive continuous improvement of Field Security processes.

What You'll Bring

• 10+ years of experience in information security, with at least 5 years in customer-facing security roles.
• Deep expertise in security frameworks (SOC 2, ISO 27001/27017/27018/42001, FedRAMP, NIST CSF).
• Expertise in law and regulation (GDPR, CCPA, DORA, EU AI Act).
• Proven track record of contract negotiation and security/privacy agreement reviews.
• Exceptional written and verbal communication skills.
• Strong understanding of cloud security, SaaS security models, and DevSecOps practices.
• Experience working cross-functionally with Sales, Legal, Product, and Engineering teams.
• Preferred: CISSP, CISA, CISM, CCSP, ISO 27001 Lead Implementer/Auditor, or CIPP/CIPM certifications.