Product Security Incident Response Analyst

GitHub, Inc.•UNAVAILABLE, UNAVAILABLE

2d•Remote

About The Position

GitHub is hiring a Product Security Incident Response Analyst to strengthen product security incident response across its products. The role designs and implements incident-response solutions, improves security policies and processes, and identifies opportunities for automation. It uses data analysis and forensics to investigate, scope, and resolve incidents; analyzes security metrics and telemetry; and helps ensure compliance with relevant security regulations and standards. The analyst collaborates with internal teams, external partners, engineering and architecture teams, and leaders to communicate risks, coordinate remediation, and integrate security into system and application design. The position is remote within the United States.

Requirements

At least 7 years of experience in product security, security analysis, security research, cybersecurity, security engineering, or a relevant area; alternatively, an associate degree and 6+ years, a bachelor's degree and 5+ years, a master's degree and 3+ years, a doctorate and 1+ year, or equivalent experience.
At least 1 year of experience investigating software product vulnerabilities within the development lifecycle using application security tools (SAST, DAST, SCA), and/or performing threat modeling, security design and architecture review, application security testing, and code review. Must include hands-on assessment of product impact and collaboration with engineering teams to remediate findings.
At least 1 year of experience working with GitHub and/or other open-source software platforms.

Nice To Haves

At least 9 years of experience in product security, security operations, security research, cybersecurity, security engineering, or a relevant area, including substantial hands-on software vulnerability investigation, product security incident response, and remediation coordination with engineering teams.
Experience coordinating remediation with engineering teams and drafting and publishing CVEs.
Relevant penetration testing, incident handling, or digital forensics certifications such as OSCP, GPEN, GCIH, GCFA, or GCFE; certifications do not substitute for product security experience.
Proficiency using SAST, DAST, and SCA to investigate software product vulnerabilities, validate findings, assess exploitability and product impact, and verify remediation with engineering teams—not solely operating scanners or reporting their output.
Experience with GitHub and/or other open-source software platforms.

Responsibilities

Develop and implement scalable, effective solutions to address product security incidents across GitHub products.
Use data analysis and forensics techniques to investigate, scope, and resolve product security incidents.
Continuously improve incident-response processes and solutions.
Identify, develop, and maintain automation scripts and tools to improve incident response operations and case management; collaborate with others to prioritize automation opportunities.
Engage internal teams and external partners to promote security risk awareness and best practices.
Explain complex technical information and security risks to nontechnical audiences.
Prepare and share reports with leaders about security risks and remediation strategies.
Collaborate with architecture teams to integrate security into system and application design.
Analyze incident metrics and KPIs, identify trends and anomalies across data sources, and escalate appropriately.
Recommend improvements and metrics to address telemetry and measurement gaps and strengthen incident-response capabilities.
Participate in product security incident response activities and propose security improvements based on observed patterns and trends.
Conduct risk assessments and audits to identify and address compliance gaps against relevant security regulations and standards.
Coordinate communications and stakeholder engagement during incidents, providing timely updates.
Draft and publish CVEs in coordination with relevant teams and partners.