Security Compliance Engineer, FedRAMP

An overview of this role

We are seeking a detail-oriented and experienced Security Compliance Engineer to lead our FedRAMP compliance efforts. The ideal candidate will have a strong background in cybersecurity and compliance, with specific expertise in achieving and maintaining security certifications like FedRAMP. This role will be critical in ensuring our cloud services meet the stringent security requirements set by the Federal Risk and Authorization Management Program (FedRAMP).

As an Intermediate Security Compliance Engineer, it will be your goal to advance customer trust and execute the security compliance roadmap to achieve results for customers. This role will be directly supporting the GitLab Dedicated for Government SaaS offering, FIPS-compliant software releases, as well as maturing GitLab’s compliance posture across our self-managed offerings and GitLab Inc. as a whole. 

Relevant Links:

• Security Compliance (Dedicated Markets) Team
• GitLab FedRAMP Authorization Program

What you’ll do  

• Support the development, implementation, and management of our FedRAMP compliance program, ensuring all cloud services meet or exceed FedRAMP requirements.
• Coordinate and manage the entire FedRAMP lifecycle, including initial assessment, authorization, continuous monitoring, and reauthorization processes.
• Work closely with internal teams, including IT, security, and development, to integrate FedRAMP requirements into the organization’s operations and technology stack.
• Develop and maintain comprehensive documentation, including System Security Plans (SSP), policies, procedures, and controls, to support FedRAMP compliance initiatives.
• Automate and maintain the plan of action & milestones (POA&M) and other continuous monitoring requirements.
• Conduct regular security assessments and audits to ensure continuous compliance with FedRAMP and other relevant standards.
• Monitor and analyze changes in FedRAMP requirements and guidelines, ensuring the organization remains compliant with the latest updates.
• Provide training and guidance to internal teams on FedRAMP-related topics, fostering a culture of compliance and security awareness.
• Act as the primary point of contact for FedRAMP-related inquiries and coordination with external auditors and assessors.
• Prepare and present compliance reports to senior management and stakeholders, highlighting the status of FedRAMP initiatives and any areas requiring attention.

What you’ll bring:

• Proof of U.S. citizenship and residency.
• Bachelor’s degree in Computer Science, Information Technology, Cybersecurity, or a related field; or equivalent experience in a related field.
• Minimum of 3 years of experience in security compliance or governance, risk, and compliance (GRC), preferably supporting U.S. public sector security authorizations.
• The candidate must be a U.S. citizen located within the continental U.S.
• Knowledge of FedRAMP, CMMC, NIST 800-53, NIST RMF, FISMA, or similar.
• Familiarity with cloud hyperscalers services and how they work (e.g. AWS, GCP, etc.).
• Excellent analytical, problem-solving, and project management skills.
• Strong communication and interpersonal skills, with the ability to effectively collaborate with internal teams, auditors, customers, and regulatory bodies.
• Relevant certifications such as CISSP, CISM, CISA, or similar are highly desirable.
• Ability to work independently and manage multiple projects simultaneously in a fast-paced environment.

About the team

The Security Compliance (Dedicated Markets) team works very closely with the Security Compliance (Commercial) team and is part of the Security Assurance department within the Security division. This team enables results for customers by ensuring compliance is a sales enabler. We work cross-functionally within Security and have strong relationships with Product, Engineering, and Sales.

How GitLab will support you

• Benefits to support your health, finances, and well-being
• All remote, asynchronous work environment
• Flexible Paid Time Off
• Team Member Resource Groups
• Equity Compensation & Employee Stock Purchase Plan
• Growth and development budget 
• Parental leave 
• Home office support

Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement. Additionally, studies have shown that people from underrepresented groups are less likely to apply to a job unless they meet every single qualification. If you're excited about this role, please apply and allow our recruiters to assess your application.

#LI-JM1