# Principal Security Awareness & Human Risk Engineer

**Company:** [GitLab](https://hotfix.jobs/companies/gitlab)
**Location:** Remote
**Role:** Security Engineering
**Salary:** $203k – $275k/yr
**Experience:** 10+ years
**Skills:** Security Awareness, Human Risk Management, Phishing Simulations, Instructional Design, Security Training, Security Policies, Audit Support, Control Evidence, Vendor Management, Owasp, Behavior Change
**Posted:** 2026-09-02

> Own GitLab’s global security awareness and human-risk program, leading phishing simulations, behavior-change initiatives, training platforms, vendor strategy, and audit support. Requires 10+ years scaling enterprise awareness programs and strong stakeholder influence in a distributed organization.

## Job Description

## Responsibilities
- Own and evolve GitLab’s global security awareness and education program, including annual, new-hire, role-based, targeted, executive, and microlearning content.
- Lead enterprise phishing simulations from design through deployment, analysis, and targeted follow-up.
- Apply behavior-change principles to reinforce secure habits and address priority risk behaviors.
- Build security culture through learning campaigns, Security Awareness Month, and ongoing engagement.
- Produce multimedia security awareness and education content, including video.
- Administer training and phishing platforms, including program data and reporting.
- Define and report performance indicators to Security Assurance leadership.
- Manage vendors for phishing, secure coding (OWASP) training, and video production.
- Evaluate markets and competitors, make renewal and vendor decisions, negotiate costs, and recommend in-house alternatives when appropriate.
- Collaborate on security policies, standards, and procedures.
- Coordinate audit evidence and demonstrate control effectiveness.
- Track remediation of identified gaps through closure.

## Requirements
- 10+ years of experience building or scaling global security awareness and human-risk programs in a large, globally distributed enterprise; regulated-industry experience preferred.
- SANS Security Awareness Professional (SSAP) certification or equivalent expertise building, maintaining, and measuring a mature awareness program.
- Experience running enterprise-scale phishing programs and organization-wide awareness campaigns.
- Experience evaluating, selecting, consolidating, or replacing security training vendors, including cost and value analysis.
- Instructional design capability.
- Working knowledge of security policy development, audit support, and control evidence.
- Ability to influence enterprise strategy across technical and non-technical teams without formal authority.
- Ability to make complex security topics practical and engaging in an all-remote organization.
- Experience onboarding, managing, and negotiating with third-party vendors.

## Compensation and Benefits
- United States base salary: **$203,200–$275,000 USD**.
- Benefits include flexible paid time off, team member resource groups, equity compensation and employee stock purchase plan, growth and development fund, and parental leave.

## Similar jobs

- [Principal Security Researcher](https://hotfix.jobs/jobs/1ceb0cbb-1f4e-4652-8d72-4e04a6b901ef) - GitLab - Remote - $203k – $275k/yr
- [GRC Principal - Data Privacy and Security](https://hotfix.jobs/jobs/38077c67-8197-4a7b-8873-908a51fba716) - Wrapbook - Remote - $143k – $232k/yr
- [Staff Security Engineer, Cloud and Product Security](https://hotfix.jobs/jobs/6f63ec23-4c3f-4815-b236-397f5ba0189d) - Lob - Remote - $198k – $220k/yr
- [Staff Application Security Engineer](https://hotfix.jobs/jobs/7ac2e48a-851e-4e49-8cb6-83a44f82862c) - Upside - Remote - $210k – $230k/yr
- [Staff Engineer - Container Security](https://hotfix.jobs/jobs/935b4780-2b70-443a-b457-18e396232e5a) - Illumio - Sunnyvale, CA - $194k – $233k/yr

**Apply:** https://hotfix.jobs/jobs/78ef4cbc-f12c-4557-b84e-ae3ad525db78
**Canonical:** https://hotfix.jobs/jobs/78ef4cbc-f12c-4557-b84e-ae3ad525db78