Senior Risk Analyst

GitHub, Inc.•UNAVAILABLE, UNAVAILABLE

1d•Remote

About The Position

GitHub is seeking a detail-oriented individual contributor with technical risk management experience to join the Technical Risk team within GRC’s Entity Risk function. The role partners with engineering, security, and product subject-matter experts and leaders across GitHub to conduct capability risk assessments, develop and quantify risk scenarios, and deliver risk reporting that supports informed decisions. The position contributes to improving risk management and security as business and sales enablers and to integrating risk management into GitHub’s product and business operations. The team emphasizes inclusion, transparency, and teamwork.

Requirements

At least 7 years of experience in security analysis, security research, cybersecurity, security engineering, software engineering, or a relevant area; alternatively, an associate degree and 6+ years, a bachelor’s degree and 5+ years, a master’s degree and 3+ years, a doctorate and 1+ year, or equivalent experience.
At least 5 years of experience applying security or control frameworks such as NIST CSF, NIST SP 800-53, or ISO/IEC 27001.
At least 5 years of experience in technical risk management, information security, audit, or compliance.

Nice To Haves

Experience applying cyber risk quantification (CRQ) using FAIR or a comparable quantitative risk analysis method, including developing risk scenarios and estimating loss event frequency and loss magnitude to produce defensible loss exposure ranges in financial terms and support risk-informed investment and risk-acceptance decisions.
Experience with GRC platforms used to maintain risk registers and risk treatment plans, such as ZenGRC, ServiceNow GRC, Archer, or comparable platforms.
Experience building risk reporting, metrics, or automation using Azure Data Explorer (Kusto/KQL), Excel, Google Sheets, SQL, Python, or comparable tools.
Experience translating security and compliance requirements between business stakeholders and technical engineering or operations teams.
CISSP, CRISC, CISA, Open FAIR, or a comparable independent certification.

Responsibilities

Lead security capability risk assessments for assigned areas, including scoping against NIST CSF subcategories, coordinating schedules and stakeholder interviews, completing maturity scoring, and publishing assessment reports.
Analyze data from multiple sources to identify, analyze, and prioritize technical risks; develop and quantify FAIR-style cyber risk scenarios; evaluate capabilities against established frameworks; and assess potential impacts to GitHub’s products, services, customers, and business objectives.
Partner with engineering, security, and product subject-matter experts and leaders to validate findings, identify risk patterns, and translate technical insights and stakeholder feedback into practical risk recommendations.
Develop and manage risk treatment plans, drive adoption of appropriate mitigations and remediation, monitor treatment progress, and escalate unresolved or emerging risks.
Maintain the risk register and supporting records in GitHub’s GRC system of record, track mitigation progress, and provide clear, recurring risk updates to technical and non-technical leaders.