An overview of the role 

The Cybersecurity Incident Manager (Incident Commander) leads and coordinates critical security incident response across GitLab.com, GitLab Dedicated, and GitLab’s corporate environments. This role serves as the primary authority during high-impact security events, orchestrating cross-functional teams, managing incident lifecycles from detection through resolution, and driving continuous improvement in GitLab's incident response capabilities.  As the founding Incident Commander in the team, you will also build upon and mature the incident command function. While this role does not carry a formal on-call rotation, the nature of security incident response may occasionally require availability outside of core business hours for high-severity events.

Find out more about the Security Operations Department here: Security Incident Response Team

What you’ll do

• Incident Command & Crisis Leadership: Serve as the primary Incident Commander for critical and complex security events across GitLab.com and corporate infrastructure, providing decisive leadership during high-stress situations
• Cross-Functional Coordination: Orchestrate response efforts across Security Operations, Infrastructure, Legal, Engineering, Product, and executive stakeholders, maintaining clear communication streams and unified action plans
• Technical Collaboration Leadership: Lead technical calls and/or establish effective async collaboration during incidents, managing participant contributions, keeping discussions focused, and ensuring efficient progress toward resolution
• Blameless Post-Incident Reviews: Conduct comprehensive post-incident reviews and retrospectives, driving the creation of action items, process improvements, and systemic enhancements
• Playbook Development: Design, maintain, and continuously improve incident response playbooks, runbooks, and standard operating procedures for various incident scenarios in conjunction with SIRT engineers
• Process Engineering: Build and refine incident command frameworks, communication protocols, and escalation procedures that scale across a global, all-remote organization
• Training & Mentorship: Develop and deliver incident command training programs, mentor incident commanders at various levels, and build organizational muscle memory for effective incident response
• Stakeholder Communication: Translate technical incident details into clear, actionable communications for executive leadership, customers, and internal stakeholders
• Automation & Tooling: Identify opportunities for automation in incident response workflows and collaborate with engineering teams to build tools that enhance incident management capabilities
• Threat Landscape Awareness: Maintain deep understanding of current threat actors, attack vectors, and security trends to inform incident response preparedness

What you’ll bring

• 10+ years of experience in information security, with at least 5 years focused on incident response, security operations, or related disciplines
• Demonstrated experience serving as Incident Commander for critical security events in complex, distributed environments
• Command Presence: Proven ability to lead and coordinate teams during high-stress, high-impact incidents with clarity, authority, and calm decisiveness
• Strong knowledge of attacker tactics, techniques, and procedures (eg MITRE ATT&CK framework)
• Technical proficiency with cloud infrastructure (GCP, AWS), container orchestration (Kubernetes), and modern application architectures
• Experience with security information and event management (SIEM) platforms, log analysis, and security monitoring tools
• Excellent written and verbal communication skills, including the ability to communicate technical concepts to non-technical stakeholders and executive leadership
• Demonstrated ability to build relationships and coordinate effectively across security, engineering, legal, and business teams
• Ability to identify systemic issues from incident patterns and drive organizational improvements
• Share our values, and work in accordance with those values
• Nice to haves: Experience working with / in Site Reliability Engineering (SRE), DevOps, or Infrastructure Engineering; Experience with GitLab the product and familiarity with DevSecOps practices; Experience working in an all-remote or distributed team environment

Due to government requirements, you must be a United States Citizen (defined as any individual who is a citizen of the United States by law, birth, or naturalization) to fill this position. 

About the Team

The Security Operations department protects GitLab, the GitLab SaaS services, and GitLab customers on SaaS offerings. The Principal Security Incident Commander works as part of the Security Incident Response Team (SIRT), a follow-the-sun team across three geographical regions. The Signals Engineering team, Threat Intelligence, Trust and Safety, Security Logging and Red Team teams make up the rest of the Security Operations department. 

An overview of this role

As a Senior Security Engineer on GitLab’s Security Incident Response Team (SIRT), you will play a critical role in defending GitLab.com and the broader GitLab environment against evolving security threats. This role also supports our FedRAMP environment and requires U.S. citizenship and residency within the United States. You will lead high-impact incidents and investigations, drive continuous improvements in defense, detection and response capabilities, and help scale security operations through automation and intelligent workflows.

Operating within a 24/7 global environment (follow the sun model), you will own incidents end-to-end - from detection and triage through containment, eradication, and recovery - while partnering cross-functionally to strengthen GitLab’s overall security posture.

A key aspect of this role is leveraging automation and AI-driven approaches to improve detection fidelity, accelerate investigations, and reduce response times. You will help shape how modern tooling and data are applied to stay ahead of evolving adversary tactics. This role is ideal for someone who thrives in high-tempo environments, brings strong DFIR expertise, and is equally passionate about operational excellence and building scalable detection and response systems and workflows.

What you’ll do

• Lead and coordinate end-to-end incident response for high-severity security events within a 24/7 global on-call model, with this role operating during U.S. business hours.
• Prepare clear executive communications that keep stakeholders informed during incidents
• Investigate complex security incidents across cloud environments, applying strong Digital Forensics and Incident Response (DFIR) methodologies
• Partnering with Signals Engineering to design and implement detection capabilities, including SIEM use cases, alerting strategies, and telemetry pipelines
• Build and enhance automation and AI-assisted workflows to improve triage, investigation speed, and response consistency
• Partner with Threat Intelligence to contextualize threats and improve detection coverage
• Conduct root cause analysis (RCA) and lead post-incident reviews to drive continuous improvement and risk reduction
• Develop and maintain runbooks, playbooks, and operational documentation
• Collaborate cross-functionally (Engineering, Infrastructure, Legal, Product, Communications, etc) during incidents and lead proactive initiatives (e.g. tabletops)
• Mentor other engineers and help elevate the team’s overall incident response maturity

What you’ll bring

• Strong experience in security incident response and investigations in cloud-first environments
• Experience using or administering Git/GitLab in a security or engineering context
• Hands-on experience with SIEM, EDR, and/or detection engineering
• Experience with cloud platforms (AWS & GCP)
• Familiarity with threat intelligence and adversary tactics (e.g., MITRE ATT&CK)
• Experience building or working with automation (e.g., Python, scripting, SOAR platforms)
• Interest or experience in applying AI/ML or data-driven techniques to detection, triage, or response workflows
• Strong analytical and problem-solving skills; ability to operate effectively during high-severity incidents
• Excellent written communication skills with a passion for clear, actionable documentation
• Growth mindset with a proactive approach to identifying and mitigating security risks

Due to government requirements, you must be a United States Citizen (defined as any individual who is a citizen of the United States by law, birth, or naturalization) to fill this position.

About the team

The Security Incident Response Team (SIRT) is a globally distributed team of engineers split across 3 core regions; AMER, APAC and EMEA, and is at the forefront of security events that impact both GitLab.com and GitLab cloud and corporate environments. We are both reactive and proactive, leading security investigations, incident response support and response resolution, through to cyber threat analysis and detection and response engineering. Even though we’re a global team, we work together in a cross-regional manner and have automation and processes to facilitate collaboration when resolving incidents, handovers, and general collaboration for project work as well.

An overview of this role

You will engineer security improvements to the GitLab product as well as building and maintaining the tools we use to detect and prevent abuse on our SaaS platforms. A strong software engineering background with experience in large Ruby/Rails codebases is required. As an engineer on the Trust and Safety team, you will predictively identify abuse patterns and trends and build prevention systems to mitigate abusive users. The Trust and Safety team both maintains core abuse prevention platforms as well as cross functionally builds customer safety mechanisms on GitLab, such as the introduction of Compromised Password Detection for GitLab.com (link). 

This role is an ideal fit for candidates with software engineering backgrounds interested in moving into security engineering. Formal security engineering experience is not a requirement for this role.

Find out more about the Trust and Safety team and responsibilities here:

• Trust and Safety

What you’ll do  

• Maintain core abuse prevention systems and build new abuse detection rules to identify and prevent evolving abuse patterns such as platform abuse, cryptomining, platform spam and abuse of terms of service
• Maintain and build new capabilities in our in-house abuse platform
• Improve and expand agentic AI capabilities in our abuse mitigation tools 
• Collaborate with peers to deliver safety improvements for the GitLab product
• Resolve automation gaps and create efficient, automated processes
• Create and maintain documentation such as runbooks and procedures

What you’ll bring 

• Strong software development skills with experience in Ruby/Rails
• Experience working on distributed applications with large codebases and deployed in cloud environments strongly preferred
• Passion/desire to proactively develop security engineering skills
• Comfortable working in an all remote environment where results and impact matter above hours worked
• Interest in “thinking like a hacker” and defending against attacks with an “automation first” mindset
• Interest in cloud native development (Google Cloud Platform (GCP) and/or AWS)
• Interest in handling trust and safety security incidents (platform abuse, cryptomining, platform spam)

About the team

Trust and Safety is a global team tasked with keeping abusive behaviors off of GitLab.com. The team relies on automations, LLM aided predictive analysis, and user behavior analysis to proactively detect and prevent abuse on the Gitlab platform. The Trust and Safety team closely collaborates with peer teams within Security Operations, including Security Incident Response, Signals Engineering, Threat Intelligence, and the Red Team.