The posting
About GitHub
GitHub is the world’s leading platform for agentic software development — powered by Copilot to build, scale, and deliver secure software. Over 180 million developers, including more than 90% of the Fortune 100 companies, use GitHub to collaborate, and more than 77,000 organisations have adopted GitHub Copilot.
Locations
In this role you can work from Remote, United States
Overview
GitHub is seeking a detail-oriented individual contributor with a technical bent and experience in technical risk management who is driven to deepen that expertise. GitHub is committed to doing right by our customers and developing a highly effective control environment where risk is managed in a meaningful and sensible way that aligns with our business.
- Do you love the challenge of diving into the details and learning why and how things work?
- Do you find yourself always asking what would have to go wrong, and how badly?
- Do you want to see The Big Picture, and find ways to collect and organize data to tell the story?
- Do you suffer from a compulsive need to document things and “get it down on paper”?
- And last, but most certainly not least, have you already answered the question “Why are we here?” with the GRC Truth, “Because Customers”?
If so, you might be the person we are looking for!
As part of GRC’s Entity Risk function, you will join the Technical Risk team and partner with engineering, security, and product subject-matter experts and leaders across GitHub to conduct capability risk assessments, develop and quantify risk scenarios, and deliver meaningful risk reporting that helps leaders make risk-informed decisions.
Central to the team's culture is that of inclusion, transparency, and teamwork - we lift each other up to be successful! This is an excellent opportunity for an independent contributor to have a hand in elevating risk management and security as business and sales enabler as well as integrate a deeper understanding of risk management into the product and business space.
Responsibilities
- Lead security capability risk assessments for assigned areas, including scoping against NIST CSF subcategories, coordinating schedules and stakeholder interviews, completing maturity scoring, and publishing assessment reports.
- Analyze data from multiple sources to identify, analyze, and prioritize technical risks, develop and quantify FAIR-style cyber risk scenarios, evaluate capabilities against established frameworks, and assess potential impacts to GitHub – our products, services, customers, and business objectives.
- Partner with engineering, security, and product subject-matter experts and leaders to validate findings, identify risk patterns, and translate technical insights and stakeholder feedback into practical risk recommendations.
- Develop and manage risk treatment plans, drive adoption of appropriate mitigations and remediation, monitor treatment progress, and escalate unresolved or emerging risks.
- Maintain the risk register and supporting records in GitHub’s GRC system of record, track mitigation progress, and provide clear, recurring risk updates to technical and non-technical leaders.
Qualifications
Minimum Qualifications:
- 7+ years experience in security analysis, security research, cyber security, security engineering, software engineering, or relevant area; o OR Associate's Degree AND 6+ years experience in security analysis, security research, cyber security, security engineering, software engineering, or relevant area o OR Bachelor's Degree AND 5+ years experience in security analysis, security research, cyber security, security engineering, software engineering, or relevant area o OR Master's Degree AND 3+ years experience in security analysis, security research, cyber security, security engineering, software engineering, or relevant area o OR Doctorate AND 1+ year(s) experience in security analysis, security research, cyber security, security engineering, software engineering, or relevant area o OR equivalent experience.
- 5+ years experience applying security or control frameworks, such as NIST CSF, NIST SP 800-53, or ISO/IEC 27001.
- 5+ years experience in technical risk management, information security, audit, or compliance.
Preferred Qualifications:
- Experience applying cyber risk quantification (CRQ) using FAIR or a comparable quantitative risk analysis method, including developing risk scenarios and estimating loss event frequency and loss magnitude to produce defensible loss exposure ranges that express risk in financial terms and support risk-informed investment and risk-acceptance decisions.
- Experience with GRC platforms used to maintain risk registers and risk treatment plans (ZenGRC, ServiceNow GRC, Archer, or comparable).
- Experience building risk reporting, metrics, or automation using Azure Data Explorer (Kusto/KQL), Excel, Google Sheets, SQL, Python, or comparable tools.
- Experience translating security and compliance requirements between business stakeholders and technical engineering or operations teams.
- CISSP, CRISC, CISA, Open FAIR, or a comparable independent certification.
Compensation Range
The base salary range for this job is USD $124,000.00 - USD $329,200.00 /Yr.
These pay ranges are intended to cover roles based across the United States. An individual's base pay depends on various factors including geographical location and review of experience, knowledge, skills, abilities of the applicant. At GitHub certain roles are eligible for benefits and additional rewards, including annual bonus and stock. These rewards are allocated based on individual impact in role. In addition, certain roles also have the opportunity to earn sales incentives based on revenue or utilization, depending on the terms of the plan and the employee's role.
This position will be open for a minimum of 3 days, with applications accepted on an ongoing basis until the position is filled.
GitHub values
- Customer-obsessed
- Ship to learn
- Growth mindset
- Own the outcome
- Better together
- Diverse and inclusive
Manager fundamentals
- Model
- Coach
- Care
Leadership principles
- Create clarity
- Generate energy
- Deliver success
Who We Are
GitHub is the world’s leading AI-powered developer platform with 150 million developers and counting. We’re also home to the biggest open-source community on earth (and 99% of the world’s software has open-source code in its DNA). Many of the apps and programs you use every day are built on GitHub.
Our teams are dreamers, doers, and pioneers, leading the way in AI, driving humanitarian efforts around the globe, and even sending open source to Mars (and beyond!). At GitHub, our goal is to create the space you need to do your best work. We’re remote-first and offer competitive pay, generous learning and growth opportunities, and excellent benefits to support you, wherever you are—because we know that people flourish when they can work on their own terms.
Join us, and let’s change the world, together.
EEO Statement
GitHub is made up of people from a wide variety of backgrounds and lifestyles. We embrace diversity and invite applications from people of all walks of life. We don't discriminate against employees or applicants based on gender identity or expression, sexual orientation, race, religion, age, national origin, citizenship, disability, pregnancy status, veteran status, or any other differences. Also, if you have a disability, please let us know if there's any way we can make the interview process better for you; we're happy to accommodate!
- Lead security capability risk assessments for assigned areas, including scoping against NIST CSF subcategories, coordinating schedules and stakeholder interviews, completing maturity scoring, and publishing assessment reports.
- Analyze data from multiple sources to identify, analyze, and prioritize technical risks, develop and quantify FAIR-style cyber risk scenarios, evaluate capabilities against established frameworks, and assess potential impacts to GitHub – our products, services, customers, and business objectives.
- Partner with engineering, security, and product subject-matter experts and leaders to validate findings, identify risk patterns, and translate technical insights and stakeholder feedback into practical risk recommendations.
- Develop and manage risk treatment plans, drive adoption of appropriate mitigations and remediation, monitor treatment progress, and escalate unresolved or emerging risks.
- Maintain the risk register and supporting records in GitHub’s GRC system of record, track mitigation progress, and provide clear, recurring risk updates to technical and non-technical leaders.
Minimum Qualifications:
- 7+ years experience in security analysis, security research, cyber security, security engineering, software engineering, or relevant area; o OR Associate's Degree AND 6+ years experience in security analysis, security research, cyber security, security engineering, software engineering, or relevant area o OR Bachelor's Degree AND 5+ years experience in security analysis, security research, cyber security, security engineering, software engineering, or relevant area o OR Master's Degree AND 3+ years experience in security analysis, security research, cyber security, security engineering, software engineering, or relevant area o OR Doctorate AND 1+ year(s) experience in security analysis, security research, cyber security, security engineering, software engineering, or relevant area o OR equivalent experience.
- 5+ years experience applying security or control frameworks, such as NIST CSF, NIST SP 800-53, or ISO/IEC 27001.
- 5+ years experience in technical risk management, information security, audit, or compliance.
Preferred Qualifications:
- Experience applying cyber risk quantification (CRQ) using FAIR or a comparable quantitative risk analysis method, including developing risk scenarios and estimating loss event frequency and loss magnitude to produce defensible loss exposure ranges that express risk in financial terms and support risk-informed investment and risk-acceptance decisions.
- Experience with GRC platforms used to maintain risk registers and risk treatment plans (ZenGRC, ServiceNow GRC, Archer, or comparable).
- Experience building risk reporting, metrics, or automation using Azure Data Explorer (Kusto/KQL), Excel, Google Sheets, SQL, Python, or comparable tools.
- Experience translating security and compliance requirements between business stakeholders and technical engineering or operations teams.
- CISSP, CRISC, CISA, Open FAIR, or a comparable independent certification.
