Staff Manager, Product Security Response

GitHub, Inc.•UNAVAILABLE, UNAVAILABLE

1d•Remote

About The Position

GitHub is seeking a Staff Manager, Product Security Response to lead its Product Security Incident Response Team (PSIRT), the team responsible for responding to vulnerabilities in GitHub’s shipped products. This is a people-management role leading an eight-person team covering first-party vulnerability triage and remediation coordination, CVE/CNA operations, and external researcher engagement through HackerOne. The manager will set the team’s strategy, staffing model, and operational practices to sustain incident response as incident and bug bounty submission volumes grow. The role partners with Legal/CELA, Security Communications, and Microsoft’s MSRC to clarify ownership and execute credible vulnerability response. It is remote within the United States. The base salary range is USD $144,600 to $383,500 per year. Certain roles may also be eligible for benefits and additional rewards, including an annual bonus and stock.

Requirements

At least 10 years of experience in security analysis, security research, cybersecurity, security engineering, or a relevant area; or equivalent experience.
Alternatively, an associate degree and at least 9 years of relevant experience; a bachelor's degree and at least 8 years; a master's degree and at least 6 years; or a doctorate and at least 4 years.
At least 2 years of people-management experience.
At least 2 years of direct experience in product security incident response or vulnerability management, including coordinating remediation across engineering teams under time pressure.
At least 2 years of experience with CVE/CNA operations and direct engagement with the external security researcher community.

Nice To Haves

At least 2 years leading a PSIRT, CSIRT, SOC, or comparable vulnerability-management function.
At least 2 years of experience leading multidisciplinary teams across engineering, legal, and communications functions.
Experience navigating regulatory notification requirements, such as FedRAMP, and partnering with Legal/CELA on disclosure obligations.
CISSP, GIAC Certified Incident Handler (GCIH), or another relevant certification.
At least 1 year of experience working with GitHub and/or open-source software.
Familiarity with GitHub products, platform, and developer ecosystem.

Responsibilities

Establish and maintain PSIRT accountabilities, staffing model, and on-call rotation health to support sustainable incident response and researcher-facing commitments.
Own the PSIRT charter and define and maintain its scope boundaries relative to ProdSec Services, CSIRT/SIRT, Legal/CELA, and Security Communications.
Drive the CVE/CNA program, including expanding coverage to cloud products, and manage GitHub’s direct relationship with the external security researcher community.
Lead first-party vulnerability disclosure response, including triage, technical assessment, remediation coordination with Engineering, and time-sensitive vulnerability management.
Define and track team metrics and KPIs, including triage-to-handoff time, backlog aging, containment speed, and bug bounty resolution SLA; use results to guide investment and process changes.
Translate technical, potentially embargoed or TLP-marked vulnerability information into guidance for non-technical stakeholders, including executive and regulatory audiences.
Partner with Legal/CELA, Security Communications, and Microsoft’s MSRC to resolve ownership questions involving regulatory notification, coordinated disclosure, and customer communications.
Hire, develop, and performance-manage security engineers and researchers, and address workforce situations such as coverage gaps, performance concerns, and attrition risk.