Remote Senior Security Risk Analyst

GitHub, Inc.; United States; Remote; USD 124,000 - 329,000; Full time

Job summary

GitHub, Inc. is seeking a detail-oriented security risk professional to join the GRC Entity Risk function and work with engineering, security, and product teams to conduct capability risk assessments and deliver meaningful risk reporting.

You will validate findings with stakeholders, develop risk scenarios using FAIR-style methods, and manage risk treatment plans. Strong experience in security analysis, risk management, and data-driven reporting is required, with familiarity of NIST CSF, NIST SP

Qualifications

• Minimum 7+ years in security analysis, cyber security, or related field.
• 5+ years applying security or control frameworks (NIST CSF, 800-53, ISO 27001).
• 5+ years in technical risk management, information security, audit, or compliance.
• CISSP, CRISC, CISA, Open FAIR or similar certification preferred.

Responsibilities

• Lead security capability risk assessments, scope against NIST CSF, interview stakeholders, score maturity, publish reports.
• Analyze data from multiple sources to identify, analyze, and prioritize technical risks.
• Translate findings into practical risk recommendations with engineering, security, and product teams.
• Develop and manage risk treatment plans, monitor progress, elevate emerging risks.
• Maintain risk register and provide recurring risk updates to leaders.

Skills

Security analysis

Risk management

Data analysis

Stakeholder management

GRC tooling

NIST CSF

ISO/IEC 27001

Tools

Excel

Google Sheets

SQL

Python

Job description

GitHub, Inc. is seeking a detail-oriented security risk professional to join the GRC Entity Risk function and work with engineering, security, and product teams to conduct capability risk assessments and deliver meaningful risk reporting.

You will validate findings with stakeholders, develop risk scenarios using FAIR-style methods, and manage risk treatment plans. Strong experience in security analysis, risk management, and data-driven reporting is required, with familiarity of NIST CSF, NIST SP