Skip to content
CV Rocket
Get started
How it worksThe enginePricingBlogContactSign in

Open nowPosted 5 hours ago

Staff Manager, Product Security Response

GitHub93 open roles

Where
United States
Get the CV for this job

From $25 per CV, paid once. No subscription.

Your applicationOpen nowStaff Manager, Product Security ResponseGitHub · United States

  1. YouYes, apply to this one.

  2. CV RocketCV written for this posting.

  3. 25 readersRecruiter, hiring manager, skeptic. Round after round.

  4. CV RocketApplied on GitHub's own form.

The reply lands in your private mailbox

3×more interviews than doing it yourself with ChatGPT.

The clock on this job

Early applications get read.

13.4% of postings close within 7 days. Measured by our own scanner across the market. GitHub postings stay open a median of 60 days.

Share of postings closed within
  1. 2.2%1 day
  2. 4.6%3 days
  3. 13.4%7 days
  4. 21.6%14 days
  5. 36.2%30 days
  6. 59.0%60 days
This job: posted 5 hours ago

GitHub median: 60 days open

The posting

About GitHub

GitHub is the world’s leading platform for agentic software development — powered by Copilot to build, scale, and deliver secure software. Over 180 million developers, including more than 90% of the Fortune 100 companies, use GitHub to collaborate, and more than 77,000 organisations have adopted GitHub Copilot.

Locations

In this role you can work from Remote, United States

Overview

GitHub is transforming how the world builds secure software, and we are looking for a Staff Manager, Product Security Response to lead the team responsible for the last line of defense once vulnerabilities reach GitHub's shipped products: our Product Security Incident Response Team (PSIRT) .

This is a people-management role at the center of GitHub's vulnerability response posture. You will lead an 8-person team covering first-party vulnerability triage and remediation coordination, CVE/CNA operations, and external researcher engagement through HackerOne. You will set the strategy, staffing model, and operational rigor that keeps incident response sustainable as both incident volume and bug bounty submission volume continue to grow sharply year over year, while partnering closely with Legal/CELA, Security Comms, and Microsoft's MSRC to keep scope boundaries clean and response execution credible to regulators and partners.

Responsibilities

  • Establish and defend the accountabilities, staffing model, and on-call rotation health for PSIRT , ensuring both teams can sustainably execute incident response and researcher-facing commitments without relying on heroics.
  • Own the PSIRT charter and scope boundary relative to ProdSec Services, CSIRT/SIRT, Legal/CELA, and Security Comms, and hold the line on that boundary as adjacent functions try to route work back to PSIRT by default.
  • Drive the CVE/CNA program, including expansion to cover cloud products, and own GitHub's direct relationship with the external security researcher community.
  • Lead incident response for first-party vulnerability disclosures: triage, technical assessment, remediation coordination with Engineering, and lightweight command for time-sensitive vulnerability management.
  • Define and drive the team's key metrics and KPIs (triage-to-handoff time, backlog aging, containment speed, bug bounty resolution SLA), using them to identify trends and direct where investment and process changes are needed.
  • Translate highly technical, often embargoed or TLP-marked vulnerability information into clear guidance for non-technical stakeholders, including executive and regulatory audiences.
  • Partner with Legal/CELA, Security Comms, and Microsoft's MSRC to resolve ownership ambiguity at the edges of PSIRT's scope (regulatory notification, coordinated disclosure, customer communications), rather than letting it default to PSIRT by inertia.
  • Manage people: hire, develop, and performance-manage a team of security engineers and researchers; lead through active workforce situations (coverage gaps, performance management, attrition risk) with the same rigor applied to technical incident response.

Qualifications

Required Qualifications:

● 10+ years experience in security analysis, security research, cyber security, security engineering, or relevant area

o OR Associate's Degree AND 9+ years experience in security analysis, security research, cyber security, security engineering, or relevant area

o OR Bachelor's Degree AND 8+ years experience in security analysis, security research, cyber security, security engineering, or relevant area

o OR Master's Degree AND 6+ years experience in security analysis, security research, cyber security, security engineering, or relevant area

o OR Doctorate AND 4+ years experience in security analysis, security research, cyber security, security engineering, or relevant area

o OR equivalent experience

● 2+ years people management experience.

● 2+ years of direct experience in product security incident response or vulnerability management, including coordinating remediation across engineering teams under time pressure.

● 2+ years experience with CVE/CNA operations and direct engagement with the external security researcher community.

Preferred Qualifications:

● 2+ years leading a Product Security Incident Response Team (PSIRT), CSIRT, SOC, or comparable vulnerability-management function.

● 2+ years experience leading multi-disciplinary teams across engineering, legal, and communications functions.

● Experience navigating regulatory notification requirements (e.g., FedRAMP) and partnering with Legal/CELA on disclosure obligations.

● Certified Information Systems Security Professional (CISSP), GIAC Certified Incident Handler (GCIH), or other relevant certification.

● 1+ year(s) experience working with GitHub and/or open source software.

● Familiarity with GitHub's products, platform, and developer ecosystem.

Compensation Range

The base salary range for this job is USD $144,600.00 - USD $383,500.00 /Yr.

These pay ranges are intended to cover roles based across the United States. An individual's base pay depends on various factors including geographical location and review of experience, knowledge, skills, abilities of the applicant. At GitHub certain roles are eligible for benefits and additional rewards, including annual bonus and stock. These rewards are allocated based on individual impact in role. In addition, certain roles also have the opportunity to earn sales incentives based on revenue or utilization, depending on the terms of the plan and the employee's role.

This position will be open for a minimum of 3 days, with applications accepted on an ongoing basis until the position is filled.

GitHub values

  • Customer-obsessed
  • Ship to learn
  • Growth mindset
  • Own the outcome
  • Better together
  • Diverse and inclusive

Manager fundamentals

  • Model
  • Coach
  • Care

Leadership principles

  • Create clarity
  • Generate energy
  • Deliver success

Who We Are

GitHub is the world’s leading AI-powered developer platform with 150 million developers and counting. We’re also home to the biggest open-source community on earth (and 99% of the world’s software has open-source code in its DNA). Many of the apps and programs you use every day are built on GitHub.

Our teams are dreamers, doers, and pioneers, leading the way in AI, driving humanitarian efforts around the globe, and even sending open source to Mars (and beyond!). At GitHub, our goal is to create the space you need to do your best work. We’re remote-first and offer competitive pay, generous learning and growth opportunities, and excellent benefits to support you, wherever you are—because we know that people flourish when they can work on their own terms.

Join us, and let’s change the world, together.

EEO Statement

GitHub is made up of people from a wide variety of backgrounds and lifestyles. We embrace diversity and invite applications from people of all walks of life. We don't discriminate against employees or applicants based on gender identity or expression, sexual orientation, race, religion, age, national origin, citizenship, disability, pregnancy status, veteran status, or any other differences. Also, if you have a disability, please let us know if there's any way we can make the interview process better for you; we're happy to accommodate!

From $25, paid onceGet the CV for this job

What happens when you press

One press. We do the rest.

  1. A CV for this posting

    Written against GitHub's own wording, from every piece of relevant proof in your profile.

  2. 25 readers review it

    Recruiter, hiring manager, skeptic and more read every draft, round after round. You get the best round.

    The review screen in CV Rocket: how each CV was read, round by round.

  3. We apply on GitHub's form

    Our application engine gets through the hardest forms there are. Where a question needs you, AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

    An application in CV Rocket: every answer filled in on the employer's form.

  4. Every reply, sorted

    GitHub's answer lands in your private mailbox, and we classify it on arrival: interview, question, rejection.

    The CV Rocket inbox: each employer reply classified as an interview, an action or a rejection.

  5. Reply with AI

    AI helps you write the email, checks it and sends it. We show you whether the recruiter read it.

  6. The interview in your calendar

    Full integration with your calendar. The invitation goes straight in.

    An interview invitation in the CV Rocket inbox, added to the candidate's calendar.
Get the CV for this job

From $25 per CV, paid once. No subscription.

Why it works

3×

more interviews than doing it yourself with ChatGPT.

ChatGPT writes a CV and never learns what happened to it. We see every reply. For each CV we know:

  • How it was written, and how the review scored it
  • When we applied, and how long after the posting went up
  • Which posting, which company, which city
  • Who got the interview, and who heard nothing

That is how we know which CVs get called.

Get the CV for this job

From $25 per CV, paid once. No subscription.

The numbers game

More applications. More interviews.

Every application goes out with its own CV, written for that posting and paid once. Send enough of them and the law of large numbers finds you the job.

Get the CV for this job
By hand5–10
With CV Rocket100
applications a day

Nearby

Live postings like this one

Same employer first, then the same role elsewhere.

Before you press

Straight answers

Get the CV for this job

From $25 per CV, paid once. No subscription.

What if my background isn't good enough?

We make the most of the background you have. The CV uses every piece of relevant proof your profile holds, and one of the 25 readers reads your whole profile and flags what the CV left out.

Do you really apply for me?

Yes, on the employer's own form, the hardest ones included. Where a question needs you, you answer it right there and AI suggests the best answer. Don't want us applying from our IP addresses? Use our Chrome extension: we apply straight from your own browser.

Is it a subscription?

No. You pay once per CV, from $25. Every application goes out with its own CV, written for that posting.

One job. One CV.
Paid once.

Pick the posting you want. We write for it, apply for you and catch the reply.

Get the CV for this job

From $25 per CV, paid once. No subscription.