Director, Product Security Architecture

• Maximize risk reduction by identifying strategic opportunities that fit naturally into existing R&D work
• Ensure that material product security risks and tradeoffs are surfaced, acknowledged, and decided at the right leadership levels
• Lead SPA/AppSec scaling strategies that increase coverage and support non-linear developer gains, with a clear focus on enabling developer velocity with minimal friction

• Lead, develop, and mentor a team of Product Security Architects and closely-aligned specialists who are dedicated to major product functional areas (e.g., Sec Section, AI, Core DevOps)
• Own and continuously evolve the Product Security Architecture strategy and partnership model, shifting architects from embedded consultants to accelerators of secure architecture delivery, and serve as a strategic partner to Product and Engineering Directors/VPs
• Oversee and mature the

• Define and drive security visions, standards, “paved roads,” and secure-by-default platform behaviors and configurations that enable product teams to make sound security decisions with minimal overhead, including evolving existing behaviors over time to strengthen the baseline security posture.
• Lead the Product Security AI strategy for scaling, including adoption of AI-assisted and platform-level investments that expand security review coverage, reduce toil, and support non-linear developer gains while enabling developer velocity.
• Partner with Application Security, Infrastructure Security, Security Research, Security Operations, Security Risk, and Security Compliance on end-to-end risk reduction, including security-related controls, quality standards, and integration of research and operational learnings into architectures.
• Define and track meaningful architecture-related metrics and Key Risk Indicators, and represent Product Security in cross-functional forums, clearly articulating risk, tradeoffs, and recommended paths forward.

• Significant experience (typically 10+ years) leading software, architecture, or application security initiatives in high-velocity R&D organizations, with a strong grounding in building and evolving complex software systems
• Strong application security and secure design literacy, whether from direct AppSec roles or from owning secure delivery of large-scale systems, including familiarity with common vulnerability classes, modern software architectures, and practical mitigation patterns
• Deep understanding of systemic product security risks in large-scale platforms, with expertise in at least some of: CI/CD and pipeline security, software supply chain security, identity and access management (AuthN/Z), AI/ML security, or multi-tenant SaaS architectures
• Proven ability to operate effectively in constrained environments: balancing business goals and risk reduction, focusing attention on the highest-impact, hardest-to-reverse decisions, and framing options in terms of risk, cost, and customer impact rather than absolutes.
• Demonstrated success building trust with Product and Engineering Directors/VPs, influencing multi-quarter roadmaps, and co-owning outcomes rather than acting solely as a gate.
• Experience designing and rolling out scalable security patterns-standards, “paved roads,” and secure-by-default configurations-that reduce risk while minimizing additional toil for product and engineering teams.
• Experience collaborating with Compliance, Audit, and Security Operations on the definition, implementation, and demonstration of security controls and security-related quality standards, and translating technical designs into clear language for auditors, engineers, and senior leaders.
• Experience supporting organizations through significant technology and architectural change (e.g., adoption of new languages and frameworks, or evolution from monoliths toward microservices or domain-oriented architectures) while maintaining or improving security posture.
• Ability to operate at multiple altitudes-from executive-level strategy and stakeholder alignment down to detailed technical design discussions when necessary-with excellent written and verbal communication in an all-remote, asynchronous environment.
• Comfort with AI-augmented workflows and enthusiasm for leveraging tools like GitLab Duo to scale the Product Security Architecture function, along with strong alignment to GitLab's

GitLab