Senior Technical Security Program Manager, PSIRT

An overview of this role

As a GitLab Product Security Incident Response Team (PSIRT) Technical Program Manager (TPM), you will work with a diverse team to respond to reports of security issues in GitLab products and services to drive technical solutions that strengthen customer defenses. You'll help define new operational runbooks and provide invaluable end-to-end insights regarding security posture and threat landscape. You'll engage with engineers and researchers to advance platform security and protect GitLab customers from security and privacy threats.

Attention to detail, ability to respond effectively to changing workloads and priorities, and staying organized are critical skills required for the role. A sense of curiosity, strong program management experience, and a desire to work as part of a team will make you a strong candidate for this role.

What You’ll Do

• Triage, initial assessment, & issue management of product application and infrastructure vulnerabilities reported to GitLab 
• Manage GitLab’s CNA operations, assigning CVEs as appropriate
• Collaborate with security engineering partners on issues that require complex technical reproduction
• Act as the customer advocate in managing security risk, ensuring issues are prioritized and remediated at an appropriate velocity, escalating to senior leadership as appropriate
• Drive internal and external customer communications in partnership with Legal, Corporate Communications, Customer Success, etc.
• Report on issue trends and business impact, tracking completion of key results
• Define and implement operational improvements to issue handling
• Manage Bug Bounty operations and drive bounty program strategy.
• Create simple documentation such as runbooks and procedures to improve quality, efficiency, and transparency
• Drive cross-functional engineering collaboration to document root cause analysis (RCA), lessons-learned and product incident reviews

What you’ll bringRequired experience

• 5+ years of experience in product security response (PSIRT) organization, with hands-on experience defining and driving product security incident response processes, tools, techniques and strategies. 
• Familiarity with security response standard practices and terminology such as CVE, CVSS, CWE, OWASP top 10, STRIDE model, etc.
• Strong collaboration skills and ability to work with cross-functional teams
• Effective verbal and written communication skills; demonstrated ability to communicate in an inclusive manner with a global audience through Technical Writing or similar experience.

Preferred experience

• Experience working with HackerOne or Bugcrowd bounty platforms
• Experience interacting with security researchers participating in Coordinated Vulnerability Disclosure and/or bug bounty programs.
• Experience generating and analyzing metrics with QuickSight, Tableau, PowerBI, or similar analysis software to measure service and program effectiveness and consistency.
• 5+ years of project management experience and demonstrated knowledge of program management best practices

Personal qualities

• Confidence navigating ambiguity and identifying innovative solutions with minimal direction.
• Strong attention to detail, especially regarding security implications
• Self-motivated with ability to work independently while collaborating remotely
• Alignment with GitLab's values of collaboration, results, efficiency, diversity, inclusion & belonging, iteration, and transparency

Some travel may be required (up to 10%)

About the team

The GitLab Product Security Incident Response Team (PSIRT) is a globally distributed team of engineers that ensures GitLab delivers secure applications customers can trust. The PSIRT acts as a central point of contact for external security researchers reporting vulnerabilities in GitLab’s products and governs policies, processes, and guidelines for addressing security vulnerabilities that may affect GitLab’s in-market and supported products.

Even though we’re a global team, we work together in a cross-regional manner and have automation and processes to facilitate collaboration when resolving incidents, handovers, and general collaboration for project work as well.

How GitLab will support you

• Benefits to support your health, finances, and well-being
• All remote, asynchronous work environment
• Flexible Paid Time Off 
• Team Member Resource Groups
• Equity Compensation & Employee Stock Purchase Plan
• Growth and Development Fund
• Parental leave 
• Home office support

Please note that we welcome interest from candidates with varying levels of experience; many successful candidates do not meet every single requirement. Additionally, studies have shown that people from underrepresented groups are less likely to apply to a job unless they meet every single qualification. If you're excited about this role, please apply and allow our recruiters to assess your application.