# Senior Security Assurance Engineer

**Company:** [GitLab](https://hotfix.jobs/companies/gitlab)
**Location:** Remote
**Role:** Security Engineering
**Salary:** $139k – $196k/yr
**Experience:** 5+ years
**Skills:** It General Controls, Sox Itgc, SOC 2, ISO 27001, Iso 42001, Nist Csf, Pci-Dss, Identity And Access Management, SSO, SCIM, RBAC, Privileged Access, Ai Governance, Compliance Automation, GitLab
**Posted:** 2026-09-03

> Owns technology compliance and security assurance controls across corporate and business systems, aligning evidence for SOX, SOC 2, ISO, regulatory, and contractual obligations. The role requires 5+ years in compliance, audit, security, or IT, strong control-testing experience, and a bachelor's degree or equivalent.

## Job Description

## Responsibilities
- Design, document, maintain, and test IT general and security controls for corporate applications, identity infrastructure, security tooling, business systems, and relevant third-party SaaS.
- Map shared controls across SOX, SOC 2, ISO 27001, ISO 42001, NIST CSF, PCI-DSS, privacy regulations, and customer contractual commitments.
- Serve as the compliance liaison for IT, Corporate Security, Engineering, Finance, Security Governance, Security Risk, Internal Audit, the SOX PMO, Legal, and Privacy.
- Define control expectations for AI tools, agents, and integrations, including acceptable use, evidence requirements, data handling, access scope, human review, and logging.
- Contribute to security policies, standards, procedures, policy reviews, attestations, and Acceptable Use Policy adherence.
- Run recurring access reviews, privileged-access reviews, segregation-of-duties reviews, change-management testing, and configuration-baseline monitoring.
- Assess implementations, migrations, and significant changes for control readiness before go-live.
- Manage SOX ITGC testing and auditor certification requests, direct evidence collection, and automate recurring evidence gathering where possible.
- Track and lead remediation of control deficiencies and risks; improve compliance processes, metrics, and reporting.

## Requirements
- 5+ years of experience in IT compliance, security compliance, IT audit, information security, or information technology.
- Bachelor's degree in a business or technology field, or equivalent experience.
- Experience testing and documenting controls against COSO, COBIT, NIST CSF, ISO 27001, SOC 2, and SOX ITGC.
- Experience working directly with internal or external auditors.
- Experience assessing controls in SaaS and cloud-native application environments.
- Working knowledge of identity and access management, including SSO, SCIM, RBAC, privileged access, and joiner/mover/leaver processes.
- Familiarity with AI governance and control considerations for AI tools, agents, and integrations.
- Experience contributing to security policies and standards and supporting adherence or attestation processes.
- Ability to analyze data flows across product usage, billing, subscription, and financial reporting systems.
- Exceptional written and verbal communication skills with credibility across leadership, engineering, auditors, and legal teams.
- Ability or willingness to learn GitLab.

## Nice to Have
- CISA, CISSP, CRISC, or CISM certification.
- Big Four or external audit experience.
- Experience with usage-based billing, subscription management, metering, or entitlement systems.
- Experience with compliance automation, continuous control monitoring, or enterprise AI-use standards such as ISO 42001 and NIST AI RMF.
- Security Assurance or GRC experience supporting both corporate IT and product engineering.

## Compensation
- United States base salary range: $139,200–$196,000 annually.

## Similar jobs

- [Senior Security Compliance Engineer, Public Sector](https://hotfix.jobs/jobs/3427156e-b584-45f3-8a5e-23c79be146af) - GitLab - Remote - $139k – $196k/yr
- [Senior Security Engineer](https://hotfix.jobs/jobs/bf99bce1-bf10-4938-81d3-d24f8455171f) - Pindrop - Remote - $140k – $165k/yr
- [Senior Security Engineer, Incident Response](https://hotfix.jobs/jobs/c68462e8-6fd9-48ef-99a9-0516fb5468d8) - Twilio - Remote - $142k – $208k/yr
- [Security Engineer, Detection and Response](https://hotfix.jobs/jobs/e00040ab-bd5e-47da-a22b-c36fa3dea16c) - Writer - San Francisco, CA - $132k – $258k/yr
- [Security Compliance Manager](https://hotfix.jobs/jobs/a631d7a7-01a4-496e-8e8c-97bd0b990c08) - Sardine - Remote - $130k – $190k/yr

**Apply:** https://hotfix.jobs/jobs/4db71196-4678-47f9-b8fd-a70dc317bd46
**Canonical:** https://hotfix.jobs/jobs/4db71196-4678-47f9-b8fd-a70dc317bd46