Senior Software Engineer, Vulnerability Management

GitHub, Inc.•UNAVAILABLE, UNAVAILABLE

3d•Remote

About The Position

As a Senior Software Engineer on GitHub’s Vulnerability Management Engineering team, you will build and operate systems that identify vulnerabilities across GitHub services and infrastructure, route findings to the teams responsible for them, and control how code, packages, and container images are sourced and built. The role focuses on backend and distributed systems used by other engineers, with opportunities to develop expertise in vulnerability management and software supply chain security. You will design, develop, test, and ship scalable technical solutions; build vulnerability-management and remediation-tracking platforms; and implement software supply chain controls across GitHub Actions, Docker builds, and Dependabot. You will help meet compliance requirements such as FedRAMP, maintain production services and APIs, collaborate across technical and compliance teams, and provide technical leadership through mentorship and reviews. The position also involves system health ownership, on-call participation, architecture proposals, experiments, and prototypes. The role is remote within the United States.

Requirements

At least 6 years of experience in software engineering, computer science, or a related technical discipline, with experience maintaining and delivering production software in languages such as C, C++, C#, Java, JavaScript, Go, Ruby, Rust, or Python; or equivalent experience.
Alternatively, an associate degree in a listed or related field and at least 5 years of relevant experience maintaining and delivering production software.
Alternatively, a bachelor’s degree in a listed or related field and at least 4 years of relevant experience maintaining and delivering production software.
Alternatively, a master’s degree in a listed or related field and at least 2 years of relevant experience maintaining and delivering production software.
Alternatively, a doctorate in a listed or related field.
Experience maintaining and delivering production software using one or more programming languages, including but not limited to C, C++, C#, Java, JavaScript, Go, Ruby, Rust, or Python.

Nice To Haves

At least 2 years of experience using general-purpose and scripting languages such as Go, Python, or a similar language.
At least 3 years of experience with cloud environments and/or Cloud Native Computing Foundation (CNCF) concepts.

Responsibilities

Design, develop, test, and ship high-quality technical solutions that scale across multiple GitHub services.
Build a platform that collects security findings from container image, cloud, host, and code scanning; matches findings to owning teams; and tracks remediation through risk scoring, SLAs, and exceptions.
Design and roll out software supply chain controls, such as authenticated package and container proxies that enforce policy across GitHub Actions, Docker builds, and Dependabot without slowing down adoption.
Build systems that meet compliance requirements such as FedRAMP and evolve production services without breaking APIs relied on by other teams.
Collaborate with service owners, platform engineering, cloud security, compliance, and other cross-functional teams to define and implement solutions.
Provide technical leadership, mentorship, pairing opportunities, and code reviews.
Own and advocate for the health and quality of team systems, including participating in on-call and first responder rotations.
Write architecture briefs and proposals, conduct code experiments, and build prototypes to explore planetary-scale systems.
Become deeply familiar with the systems built and write maintainable code.