• Manage day-to-day team operations - establish clear goals, performance expectations, and accountability for direct reports; monitor progress and ensure timely delivery of quality results. • Develop and coach incident responders - provide candid, real-time feedback; advise on career growth; and foster a culture of investigation excellence, prioritizing depth and accuracy of analysis. • Proactively identify and fill talent gaps - participate in hiring decisions with a focus on candidates who will amplify GitLab's values and raise the team's technical bar. • Drive engagement and retention - recognize team member contributions, address engagement risks early, and create an environment of open feedback and psychological safety. • Cascade organizational context - translate division and company-wide strategy into clear, actionable team priorities; keep team members informed in a timely manner. • Implement and mature incident response processes - build and improve runbooks, procedures, and team capabilities that translate functional plans into tactical execution. • Lead incident response - serve as an escalation point and incident commander for high-severity events, including occasional nights and weekends; model the standard for quality investigations. • Enable cross-functional collaboration - coordinate effectively with peer SecOps teams, Legal, Customer Support, and Infrastructure to resolve incidents and close defense gaps through actionable retrospective mitigations. • Align the team on defensive improvements - drive insights from alerts, investigations, and incidents to improve GitLab's security posture and support a "shift left" mindset. • Champion remote-first practices - consistently model and coach team members on GitLab's remote working best practices, async communication norms, and handbook-first culture.

• Assess, design, and improve Microsoft Entra ID / Azure AD environments • Implement and harden foundational M365 and Azure security controls • Support Identity governance, MFA, Conditional Access, PIM, RBAC, and passwordless initiatives • Assist customers with FIDO2 security key deployments and identity hardening strategies • Perform Security Architecture Reviews and technical assessments • Develop actionable remediation recommendations and implementation roadmaps • Support ITDR, SIEM, SOC, and Zero Trust aligned initiatives • Work hands-on within customer environments to validate and implement recommendations • Produce high-quality customer deliverables and technical documentation • Serve as a trusted advisor to customer security and IT teams

• Monitor security alerts and events on a daily basis using Microsoft Defender and other security tools. • Investigate suspicious activities, incidents, and anomalies on endpoints and corporate accounts. • Document security incidents and follow up on corrective actions. • Generate biweekly and monthly reports on: - Detected incidents - Relevant alerts - Policy compliance - Corporate device status - Security metrics • Verify compliance with corporate policies on laptops and assigned devices. • Monitor access controls, MFA, and user activity. • Collaborate with internal audits and compliance processes. • Maintain evidence and documentation required for SOC 2 audits. • Participate in periodic reviews of access permissions and corporate assets. • Escalate critical incidents according to established procedures. • Propose continuous improvements in security controls and monitoring.

• Own day-to-day security operations for AWS-based cloud and serverless workloads including threat detection, alert triage, incident response, forensics, and post-incident learning. • Build and tune detections and automations (SIEM rules, SOAR/runbooks, detection-as-code) to reduce MTTA/MTTR and eliminate noisy alerts. • Secure our delivery pipelines & runtime Harden CI/CD and software supply chain, and drive “secure by default” patterns in our SDLC. • Lead cloud/serverless hardening (IaC reviews, policy-as-code, least privilege IAM design, network segmentation). • Partner with DevOps and Engineering teams to evolve identity & access, endpoint/EDR posture. • Coordinate vulnerability management end-to-end: scanning, prioritization, remediation, and reporting. • Contribute to security governance (policies, standards, tabletop exercises, BCP/DR inputs) and support compliance efforts (e.g., SOC 2/PCI DSS). • Build security tooling and integrations for engineers, acknowledging that ease of use and low friction will encourage adoption and adherence. • Define metrics/KPIs and regularly communicate risk & progress to engineering and leadership. • Mentor engineers on secure design and champion a positive, enablement-first security culture. • Participate in architecture and threat modeling discussions to identify security risks early in the design process.