Remote Senior Security Risk Analyst

GitHub; United States; Remote; USD 124,000 - 329,000; Full time

Job summary

GitHub seeks a Senior Risk Analyst to join our Security team. You’ll manage technical risk, perform risk assessments, and quantify cyber risk using FAIR methods to inform investment decisions.

You will collaborate with engineers and product teams, maintain the GRC risk register, and report up to leadership. This is a remote role in the United States with opportunities to influence secure software development at scale.

Qualifications

• 7+ years experience in security analysis, security research, cyber security, security engineering, software engineering, or relevant area.
• 5+ years experience applying security or control frameworks, such as NIST CSF, NIST SP 800-53, or ISO/IEC 27001.
• 5+ years experience in technical risk management, information security, audit, or compliance.
• CISSP, CRISC, CISA, Open FAIR, or a comparable independent certification.

Responsibilities

• Lead security capability risk assessments for assigned areas, including scoping against NIST CSF subcategories, coordinating schedules and stakeholder interviews, completing maturity scoring, and publishing assessment reports.
• Analyze data from multiple sources to identify, analyze, and prioritize technical risks, develop and quantify FAIR-style cyber risk scenarios, evaluate capabilities against established frameworks, and assess potential impacts to GitHub – our products, services, customers, and business objectives.
• Partner with engineering, security, and product subject-matter experts and leaders to validate findings, identify risk patterns, and translate technical insights and stakeholder feedback into practical risk recommendations.
• Develop and manage risk treatment plans, drive adoption of appropriate mitigations and remediation, monitor treatment progress, and elevate unresolved or emerging risks.
• Maintain the risk register and supporting records in GitHub’s GRC system of record, track mitigation progress, and provide clear, recurring risk updates to technical and non-technical leaders.

Skills

Security analysis

Risk management

Data analysis

Communication

Education

Bachelor's Degree

Master's Degree

Doctorate

Associate's Degree

Tools

Azure Data Explorer

Kusto/KQL

Excel

SQL

Python

Job description

GitHub seeks a Senior Risk Analyst to join our Security team. You’ll manage technical risk, perform risk assessments, and quantify cyber risk using FAIR methods to inform investment decisions.

You will collaborate with engineers and product teams, maintain the GRC risk register, and report up to leadership. This is a remote role in the United States with opportunities to influence secure software development at scale.