CISO Tribune

Company record · security vendor

GitLab CISO: Chaim Mazal

CISO Tribune company record: GitLab, seat filled, since June 9, 2026

The current Chief Information Security Officer of GitLab, as tracked by CISO Tribune, is Chaim Mazal, whose appointment was announced on June 9, 2026 (Business Wire (company announcement)). Read the record. The record entered the Wire on .

Career profile: Chaim Mazal on CISO Spotlights ↗

What GitLab tells the SEC

Its fiscal 2026 Form 10-K, filed March 17, 2026, carries an Item 1C cybersecurity disclosure that describes a Chief Information Security Officer, with oversight by the audit committee. Read the section verbatim or the filing on sec.gov. A filing describes governance as of its date, not today's seat.

Tracked by the Wire since June 13, 2023 · 2 recorded moves · every claim links to a sourced record · Updated

Where GitLab appears on the record (51)

Every page on CISO Tribune and its network that carries this company, 51 in all.

On the Wire (2)
SEC filing
Career profile
Compared with (43)

vs AISLE, vs Anchore, vs Apiiro, vs Aqua Security, vs Archipelo, vs Arnica, vs Black Duck, vs Chainguard, vs Checkmarx, vs Clutch Security, vs Cycode, vs Data Theorem, vs Endor Labs, vs Finite State, vs Fleuret AI, vs GitGuardian, vs GitHub Advanced Security, vs HashiCorp, vs Invicti, vs JFrog, vs Kiuwan, vs Legit Security, vs Mend.io, vs Minimus, vs Neo, vs Oligo, vs OpenText, vs OX Security, vs Phoenix Security, vs Pluto Security, vs Prime Security, vs Promptfoo, vs RapidFort, vs Raven.io, vs Red Hat, vs Semgrep, vs Snyk, vs Socket, vs Sonatype, vs SplxAI, vs Trail of Bits, vs Truffle Security, vs Veracode

In the vendor directory (4)

How the top security seat at GitLab has changed hands

CISO Tribune's record names 2 people in the top security seat at GitLab, the most recent first. Each line rests on the record linked beside it.

  • Chaim Mazal: named Chief Information Security Officer, announced on June 9, 2026 (record).

  • Josh Lemos: named Chief Information Security Officer, announced on June 13, 2023 (record).

About GitLab

CISO Tribune's Leadership Bench files GitLab under Technology and North America. The SEC classifies it under standard industrial classification 7372, Services-prepackaged software, and EDGAR lists its ticker as GTLB. The Wire has 2 security-leadership moves at GitLab on record, the earliest announced on June 13, 2023.

What GitLab's 10-K says about security governance

GitLab's fiscal 2026 Form 10-K, filed March 17, 2026, describes its cybersecurity governance in Item 1C. The lines below are that filing's own statements, each with the sentence it comes from.

  • Top security role, as the filing names it: Chief Information Security Officer.

  • Board oversight: the audit committee.

    “The audit committee has oversight responsibility for risks and incidents relating to cybersecurity threats, including compliance with disclosure requirements and related effects on financial and other risks, and it reports any findings and recommendations, as appropriate, to the full board of directors for consideration.”

  • Experience of the security leadership, as the filing states it:

    “Our interim CISO has over 25 years of experience working at SaaS and technology companies and we expect our security program will continue to operate as it has in the prior fiscal year.”

  • Material incidents: the filing states none.

    “As of the date of this Form 10-K, to the best of our knowledge and based on available data, we have not experienced a material cybersecurity incident that has resulted in a material adverse impact to our business or operations.”

Plain-English reading and full text of the filing · the filing on sec.gov

Security leadership timeline

2026-06-09

Chaim Mazal named Chief Information Security Officer at GitLab

GitLab announced the appointment of Chaim Mazal as Chief Information Security Officer, framing the role around defining what AI security looks like for the next generation of software development.

2023-06-13

Josh Lemos named Chief Information Security Officer at GitLab

GitLab announced the appointment of Josh Lemos as Chief Information Security Officer.

Previous security leaders of GitLab

  • Josh Lemos: named Chief Information Security Officer, announced on June 13, 2023 record

What Chaim Mazal has said in public

CISO Tribune's Voices section carries 1 public post or talk by Chaim Mazal. The most recent are listed with their dates.

Chaim Mazal's record

Security chiefs at other Technology organizations

Other organizations CISO Tribune files under Technology with a named security chief on record: those in North America first, in alphabetical order from GitLab onward.

  • Glow: Patti Degnan, Chief Information Security Officer.

  • Gong: Guy Havusha, Chief Information Security Officer (CISO).

  • HubSpot: Geoff Belknap, Chief Trust Officer.

  • IonQ: Leslie Kershaw, Chief Information Security Officer.

  • isolved: Satyam Patel, Chief Information Security Officer.

  • Jamf: Mario Villatoro, Chief Information Security Officer.

  • JumpCloud: Roland Palmer, Chief Information Security Officer (CISO) and Vice President of Security.

  • Jumpmind: Eric Zielinski, Chief Information Security Officer.

The full Technology bench

What the company sells

GitLab states that software teams and their agents plan, build, secure, and ship on one control plane. GitLab describes that control plane as covering unified context, orchestration, security and governance, and execution on GitLab Core. GitLab combines planning, source control, and CI/CD in one platform, and projects, releases, and code share one data plane.

GitLab runs four peer pillars on one foundation. Execution and Workflows covers planning, source code management, CI/CD pipelines, registry, and delivery. Security and Governance covers application security, software composition analysis, compliance management, and agent governance. Context and Data covers analytics, value stream visibility, and lifecycle context including Context Graph. Agentic Orchestration covers GitLab Duo Agent Platform: agents, agentic workflows, model choice, and extensibility. Deployment and AI inference options let customers choose where GitLab runs and which models power agents.

GitLab Duo Agent Platform is how GitLab orchestrates agents across the software development lifecycle. GitLab says humans stay above the loop with policy, identity, and audit. GitLab defines intelligent orchestration as teams setting intent and guardrails while agents execute within them. Policies, approvals, and scanning in GitLab apply to human and agent changes alike. GitLab supports APIs, webhooks, integrations, and Model Context Protocol (MCP) so agents and tools share context under the customer's policies. Across deployments, GitLab customers can use GitLab-managed models or self-hosted models, and reshape seats and agent usage with GitLab Flex.

GitLab runs scanning, policies, and approvals inside the pipeline. GitLab consolidates scanners such as SAST, SCA, Secret Detection, and DAST into one platform. Security findings from GitLab appear directly in merge requests and IDEs. GitLab built-in scans run on every push to detect insecure code during development. GitLab can run automated security scans to capture vulnerabilities before code is merged. GitLab supports ensuring that passwords and sensitive information are not in source code. GitLab can find disclosed vulnerabilities in dependent software before they reach production. GitLab can generate an SBOM automatically so that every dependency in the project is known.

GitLab can block risky packages before they enter the build. GitLab describes protecting multiple attack surfaces, including code, build, dependencies, and release artifacts, with policy-as-code and continuous governance. GitLab can block malicious packages and packages above a vulnerability severity threshold before they are fetched. GitLab can scan licenses and block packages that fall outside organization policies. GitLab isolates the build environment to block unauthorized access and malicious code execution.

GitLab offers over 60 out-of-the-box controls prebuilt into a single platform. GitLab keeps code authors, reviewers, and deployers separated by policy so that no single person or agent can develop and deploy unreviewed changes. GitLab captures every human and AI-driven change in one immutable audit trail. GitLab maps controls from every major or custom framework into a single, unified compliance view. For infrastructure, GitLab includes Infrastructure as Code static and dynamic testing to help catch vulnerabilities before they get to production. GitLab integrates Flux to support pull-based GitOps workflows. GitLab stores Terraform state files and modules and shows Terraform plan output directly in the merge request.

GitLab.com is multi-tenant SaaS, and Self-Managed runs in the customer's environment on any cloud or on premises, including air-gapped patterns. GitLab Dedicated and GitLab Dedicated for Government provide single-tenant SaaS with data residency and isolation controls. GitLab can deploy to virtual machines, Kubernetes clusters, or FaaS from multiple cloud vendors. Organizations can make one annual commitment and steer their spend across seat-based licenses and usage-based credits.

GitLab provides building blocks to support compliance, certification, and standards programs for functional safety, code quality, and other requirements: ISO 26262, MISRA, IEC 61508. GitLab describes integrating virtual and physical hardware testing into automated CI. GitLab describes self-hosted and BYOM options that keep code and data inside the customer's boundary. GitLab describes shift-left policies, remediation, and release evidence that help engineer processes for DO-178C.[2][3][4][5][6][7][8][9][10][11][12][13]

Categories
Headquarters
Not established from our sources
Founded
Not established from our sources
Ownership
Public (Nasdaq Global Market: GTLB)[1][14]
CISO on record
Chaim Mazal, Chief Information Security Officer (appointment announced on June 9, 2026)
Website
about.gitlab.com

Products and services

Product names as the company writes them; what each does, in our words, from the company's own product pages. Never how well it does it.

  • GitLab Duo Agent Platform[3]

    Orchestrates agents across the software development lifecycle.

    Foundational, custom, and external agents run flows for planning, coding, review, security, and CI/CD. Humans stay above the loop with policy, identity, and audit. GitLab Duo Agent Platform covers agents, agentic workflows, model choice, and extensibility.

  • GitLab.com[3]

    GitLab.com is multi-tenant SaaS.

    GitLab.com is a multi-tenant SaaS deployment of GitLab. Across deployments, customers can use GitLab-managed models or self-hosted models.

  • Self-Managed[3]

    Self-Managed runs in the customer's environment.

    Self-Managed runs in the customer's environment. Self-Managed runs on any cloud or on premises, including air-gapped patterns.

  • GitLab Dedicated[3]

    Single-tenant SaaS with data residency and isolation controls.

    GitLab Dedicated provides single-tenant SaaS. GitLab Dedicated provides data residency and isolation controls.

  • GitLab Dedicated for Government[3]

    FedRAMP Moderate authorized single-tenant SaaS.

  • CI/CD Catalog[9]

    A shared, versioned home for tested components.

    The CI/CD Catalog is a shared, versioned home for tested components. Teams publish versioned, reusable components once.

Competitors and alternatives

The other companies on our record filed under the same categories, category by category: first those that lead with that category and share more of GitLab's categories, then alphabetical. A list from the record, never a ranking.

What review platforms show

The headline rating and review count each platform showed in public search results on the day we looked, with the link. We do not read or reproduce the reviews, and a rating is the platform's, not ours.

  • G2 · no rating shown · 904 reviews[14]seen November 10, 2026

References

Every fact above cites one of these by number. Tier A is the company itself, a regulator or a filing; tier B is trade or business press.

  1. [1]CompanyGitLab · about.gitlab.com · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
  2. [2]about.gitlab.comGitLab · about.gitlab.com · undated page, accessed November 5, 2026 · Tier A: the company, a regulator or a filing
  3. [3]GitLab Platform - Speed with controlGitLab · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
  4. [4]GitLab - Speed with control for agentic software engineeringGitLab · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
  5. [5]Application security testingGitLab · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
  6. [6]Software Supply Chain SecurityGitLab · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
  7. [7]Software compliance automationGitLab · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
  8. [8]GitOps infrastructure automationGitLab · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
  9. [9]Continuous Integration and Delivery (CI/CD)GitLab · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
  10. [10]GitLab for automotive softwareGitLab · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
  11. [11]GitLab for aerospace and defenseGitLab · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
  12. [12]GitLab ServicesGitLab · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
  13. [13]GitLab for StartupsGitLab · undated page, accessed November 10, 2026 · Tier A: the company, a regulator or a filing
  14. [14]GitLab Reviews 2026: Details, Pricing, & FeaturesG2 · undated page, accessed November 10, 2026 · Tier C

Last verified November 5, 2026. Our code found the quoted passage behind each fact on its source page when the fact was recorded, and re-checks every record against its sources each month.

Recorded November 5, 2026, expanded November 10, 2026 from the references above.

Work for GitLab? Suggest a correction to a fact on this page (with a source on your own domain), or claim this entry by publishing a small file on your domain.

Questions CISOs ask about GitLab

Who is the CISO of GitLab?
Chaim Mazal is the current Chief Information Security Officer of GitLab on CISO Tribune's record, appointed on June 9, 2026.
How many security-leadership moves has CISO Tribune tracked at GitLab?
CISO Tribune has tracked 2 moves at GitLab since June 13, 2023.
When was Chaim Mazal appointed at GitLab?
Chaim Mazal's appointment as Chief Information Security Officer of GitLab was announced on June 9, 2026, per Business Wire (company announcement).
Who are the security chiefs at other Technology organizations?
On CISO Tribune's record they include Patti Degnan at Glow, Guy Havusha at Gong, Geoff Belknap at HubSpot and Leslie Kershaw at IonQ.
Has Chaim Mazal spoken or written publicly?
CISO Tribune's Voices section carries 1 public post or talk by Chaim Mazal, the most recent dated September 2, 2026.
Which board body oversees cybersecurity at GitLab?
GitLab's fiscal 2026 Form 10-K places oversight of cybersecurity risk with the audit committee.
What does GitLab sell?
GitLab sells GitLab Duo Agent Platform, GitLab.com, Self-Managed, GitLab Dedicated, GitLab Dedicated for Government and CI/CD Catalog. GitLab Duo Agent Platform: Orchestrates agents across the software development lifecycle. GitLab.com: GitLab.com is multi-tenant SaaS. Self-Managed: Self-Managed runs in the customer's environment. GitLab Dedicated: Single-tenant SaaS with data residency and isolation controls.
Who does GitLab fit?
GitLab offers Self-Managed for customers that run it on any cloud or on premises, including air-gapped patterns. GitLab addresses teams that build spacecraft, aviation, and defense software. GitLab describes running agentic work on-prem or BYOM when ITAR and IP demand it. GitLab addresses teams that move software from commit to vehicle, with SLSA-ready controls and SBOM visibility.
How does CISO Tribune file GitLab?
CISO Tribune files GitLab under Static application security testing, with Software composition analysis, Secrets detection and Software supply chain security as secondary categories.
Who owns GitLab?
GitLab is publicly listed on Nasdaq Global Market under the ticker GTLB.

Related guides