As a member of the Security department, the Security Assurance sub-department provides GitLab customers with a high level of assurance around the security of GitLab SaaS service offerings.
There are five teams in the Security Assurance sub-department.
The Security Assurance sub department utilizes a variety of tools to carry out day to day activities. The system admin is responsible for the following:
Configuration changes
Onboarding/offboarding/transfers (ie Access)
Upgrades/patching/incidents
Migrations to new environments
Restores from backup
Admin level audit evidence
Quality oversight (limited scope)
All other actions are the responsibility of the assigned DRI.
Key system utilized for the creation and distribution of our security training and phishing simulations to provide ongoing testing for adherence of various compliance frameworks.
The goal of this handbook page is to document the goals and priorities for the automation in compliance within the Security Compliance team at GitLab. Automations are built and enabled through the support of GitLab’s Security Assurance Automation team for technical implementations.
Core Focuses
Support the business by automating security processes, compliance controls, and finding automation efficiencies.
Develop and maintain automated solutions that enhance our security posture, streamline compliance efforts, and provide continuous monitoring of our systems and infrastructure.
Enable security to scale through the discovery and application of compliance automation.
Key priorities for Compliance Automation (in order)
Control Automations - Automated testing and alert on failures of controls
Control Automations - Automated testing and workbook creation
Metrics - Key insights into compliance/risk metrics to inform scope
User Access Reviews - Process automation and risk based review enablement
Process Automations - Process automation around compliance activities such as observation management, audit management, etc.
Possible areas of opportunity
Developing and implementing automated security controls and processes
Creating and maintaining compliance automation tools and scripts
Integrating security and compliance checks into CI/CD pipelines
Automating vulnerability scanning and remediation processes
Implementing automated security testing and validation
Developing dashboards and reporting tools for security metrics and compliance status
Collaborating with other security teams to identify automation opportunities
Continuously improving and optimizing existing compliance automation solutions
The Field Security team serves as the public representation of GitLab’s internal Security function. Our vision is to be the leading example in collaborative and transparent Customer Assurance Programs. Our mission is to empower the GitLab community with confidence and trust that their data is protected with high levels of security assurance to drive revenue growth. We partner with our fellow GitLab team members and customers to provide a pathway to yes!
The Compliance Production Readiness Assessment is a process designed to make it clear what obligations systems owners have for configuring and hardening a system/tool/service in order for GitLab to meet its compliance and regulatory obligations.
