Senior Technical Security Program Manager, GitLab

• Attention to detail, ability to respond effectively to changing workloads and priorities, and staying organized are critical skills required for the role
• A sense of curiosity, strong program management experience, and a desire to work as part of a team will make you a strong candidate for this role
• 5+ years of experience in product security response (PSIRT) organization, with hands-on experience defining and driving product security incident response processes, tools, techniques and strategies
• Familiarity with security response standard practices and terminology such as CVE, CVSS, CWE, OWASP top 10, STRIDE model, etc
• Strong collaboration skills and ability to work with cross-functional teams
• Effective verbal and written communication skills; demonstrated ability to communicate in an inclusive manner with a global audience through Technical Writing or similar experience
• Confidence navigating ambiguity and identifying innovative solutions with minimal direction
• Strong attention to detail, especially regarding security implications
• Self-motivated with ability to work independently while collaborating remotely
• Alignment with GitLab's values of collaboration, results, efficiency, diversity, inclusion & belonging, iteration, and transparency

Desirable

• As a GitLab Product Security Incident Response Team (PSIRT) Technical Program Manager (TPM), you will work with a diverse team to respond to reports of security issues in GitLab products and services to drive technical solutions that strengthen customer defenses
• You'll help define new operational runbooks and provide invaluable end-to-end insights regarding security posture and threat landscape
• You'll engage with engineers and researchers to advance platform security and protect GitLab customers from security and privacy threats
• Triage, initial assessment, & issue management of product application and infrastructure vulnerabilities reported to GitLab
• Manage GitLab’s CNA operations, assigning CVEs as appropriate
• Collaborate with security engineering partners on issues that require complex technical reproduction
• Act as the customer advocate in managing security risk, ensuring issues are prioritized and remediated at an appropriate velocity, escalating to senior leadership as appropriate
• Drive internal and external customer communications in partnership with Legal, Corporate Communications, Customer Success, etc
• Report on issue trends and business impact, tracking completion of key results
• Define and implement operational improvements to issue handling
• Manage Bug Bounty operations and drive bounty program strategy
• Create simple documentation such as runbooks and procedures to improve quality, efficiency, and transparency
• Drive cross-functional engineering collaboration to document root cause analysis (RCA), lessons-learned and product incident reviews