Remote Senior Product Security Incident Response Engineer

GitHub; United States; Remote; USD 124,000 - 329,000; Full time

Job summary

GitHub is seeking a Senior Product Security Incident Response Analyst in the United States. You will design and implement solutions to address product security incidents, enhance security policies, and drive automation.

This role emphasizes collaboration with architecture teams and leadership to embed security from design through deployment. The ideal candidate has extensive product security experience, hands-on vulnerability assessment, and a track record of publishing CVEs.

Qualifications

• 7+ years in product security, security analysis, or related field.
• Experience investigating software product vulnerabilities in the development lifecycle with SAST/DAST/SCA and threat modeling.
• Experience coordinating remediation and drafting/publishing CVEs.
• Hands-on with GitHub or open-source platforms.

Responsibilities

• Develop and implement solutions to address product security incidents across all GitHub products, ensuring scalability and effectiveness.
• Utilize advanced data analysis and forensics techniques to investigate, scope and resolve product security incidents.
• Continuously improve incident response processes and solutions over time.
• Identify and implement automation opportunities to enhance efficiency and effectiveness in incident response operations.
• Collaborate with teams to prioritize and invest in valuable automation efforts.

Skills

Product security

Security analysis

Security research

Cyber security

Security engineering

Threat modeling

Application security

Code review

GitHub experience

SAST

DAST

SCA

CVEs coordination

OSCP

GPEN

GCIH

GCFA

GCFE

Tools

SAST

DAST

SCA

Job description

GitHub is seeking a Senior Product Security Incident Response Analyst in the United States. You will design and implement solutions to address product security incidents, enhance security policies, and drive automation.

This role emphasizes collaboration with architecture teams and leadership to embed security from design through deployment. The ideal candidate has extensive product security experience, hands-on vulnerability assessment, and a track record of publishing CVEs.