Staff Product Designer, Security & Compliance

Staff Product Designer, Security and Compliance

GitLab is seeking a Staff Product Designer to lead design for complex initiatives, mentor fellow designers, and elevate the craft and quality of our Security experience.

About the Role

As a Staff Product Designer for Security & Compliance, you'll lead design for complex security experiences that help organizations protect their software supply chain, manage vulnerabilities, and meet compliance requirements. This role sits at the intersection of deep technical security concepts and user-centered design—translating intricate workflows into clear, usable experiences for developers and security teams.

Your initial focus will be on Software Supply Chain Security (provenance and attestation, signing and verification, dependency firewall, SBOM, and malicious package detection). Over time, your work will span the broader Security & Compliance portfolio, including application security scanners, policy governance, vulnerability management, and agentic orchestration. You'll partner closely with Product Management and Engineering to ensure independently-owned features connect into coherent customer workflows.

This role requires deep systems thinking. Security decisions ripple across the platform—from CI/CD pipelines to registries to deployment. You'll define interaction patterns that scale across product areas, contribute foundational components to our Pajamas Design System, and help establish the design language for how GitLab communicates risk, trust, and compliance status to users.

Staff designers are key culture carriers who model collaboration, iterative ways of working, and high craft standards while mentoring other designers in the organization.

What You’ll Do

• Lead design for security and compliance experiences – Drive end-to-end design for complex security workflows across the software supply chain, including application security scanner, dependency firewall, SBOM, malicious package detection, vulnerability triage, and agentic orchestration. Define both tactical solutions for immediate user problems and strategic patterns that connect to longer-term platform vision.
• Translate technical complexity into clarity – Partner with subject matter experts to transform technical complexity into accessible, value-focused experiences for different user types—from security practitioners to developers who need security integrated seamlessly into their workflow.
• Partner cross-functionally –  Coordinate across multiple security product groups to align on cohesive experiences. Work closely with Product Managers and Engineering Managers to shape priorities, scope MVCs, and ensure design intent is maintained through development. 
• Elevate craft and quality<...