Product Security Engineer - Static Code Analysis Support

Posted Apr 19

GitHub is changing the way the world builds security software and we want you to help change the way we secure GitHub. We're looking for engineers to support our internal Code Analysis team.

The Code Analysis team is part of GitHub's internal Product Security Engineering org and is responsible for keeping GitHub secure by driving the adoption of GitHub Advanced Security features -- CodeQL, secret scanning and Dependabot -- and our custom security tools internally at GitHub. Our aim is for our automated tools to be a joy for GitHub engineers to use and this role is a key part of making that possible.

We're looking for candidates with a passion for security to support our engineering teams with the adoption of security tools. You will be a point of contact for engineering teams within GitHub to answer questions about the tools. You'll also be helping engineers to understand the findings from the tools, the underlying root cause and suggest potential fixes to engineers. Your customers will be other engineers here at Github, diving into their codebases. You'll also be responsible for summarizing engineer feedback and sharing that internally with Github's security products team to improve these features for our customers and the opensource community.

You will be a member of the Code Analysis team, which builds and maintains internal tools to track vulnerabilities found via our static analysis tools as well as the public bug bounty program, internal Red Team operations and internal code review. This is the cornerstone of how we track vulnerabilities from discovery to remediation across the whole company. In addition to supporting our engineers outside of the security organization who use these tools, you'll also be working with other security teams such as the bug bounty, code review and red teams to ensure that their needs are met.

Your responsibilities will include:

  • Supporting GitHub engineers with the triage of CodeQL, secret scanning and Dependabot alerts
  • Writing internal documentation for GitHub engineers detailing common static analysis issues
  • Suggesting rule and documentation improvements back to the CodeQL team
  • Being a point of contact internally at GitHub for CodeQL support and collaborating with the wider CodeQL team
  • Improving our internal documentation and processes


  • Experience with common web security vulnerabilities
  • Excellent written and verbal communication allowing you to clearly explain vulnerabilities to engineering teams
  • Excellent problem solving skills you might not have all of the answers, but you know how to find and communicate solutions
  • Experience writing software in Ruby, JavaScript or Go

A bonus if you have:

  • Experience with Ruby on Rails and/or Go security vulnerabilities
  • Experience using CodeQL and writing CodeQL queries
  • Experience with static analysis tooling and triaging results
  • Experience working with large codebases and engineering teams

(Colorado only) Minimum salary of 85,700 to maximum 179,000 + bonus + equity + benefits.
Note: Disclosure as required by sb19-085 (8-5-20) of the minimum salary compensation for this role when being hired in Colorado.

Who We Are:

GitHub is the developer company. We make it easier for developers to be developers: to work together, to solve challenging problems, and to create the world’s most important technologies. We foster a collaborative community that can come togetheras individuals and in teamsto create the future of software and make a difference in the world.

Leadership Principles:

Customer Obsessed - Trust by Default - Ship to Learn - Own the Outcome - Growth Mindset - Global Product, Global Team - Anything is Possible - Practice Kindness

Why You Should Join:

At GitHub, we constantly strive to create an environment that allows our employees (Hubbers) to do the best work of their lives. We've designed one of the coolest workspaces in San Francisco (HQ), where many Hubbers work, snack, and create daily. The rest of our Hubbers work remotely around the globe.

We are also committed to keeping Hubbers healthy, motivated, focused and creative. We've designed our top-notch benefits program with these goals in mind. In a nutshell, we've built a place where we truly love working, we think you will too.

GitHub is made up of people from a wide variety of backgrounds and lifestyles. We embrace diversity and invite applications from people of all walks of life. We don't discriminate against employees or applicants based on gender identity or expression, sexual orientation, race, religion, age, national origin, citizenship, disability, pregnancy status, veteran status, or any other differences. Also, if you have a disability, please let us know if there's any way we can make the interview process better for you; we're happy to accommodate!

Please note that benefits vary by country. If you have any questions, please don't hesitate to ask your Talent Partner.

Misc Info For This Position:

Remote Mix: 100% Remote

Job Type: Full-Time

Regional Restrictions: North America Only

Apply for this Position


San Francisco,CA
United States


Job Info:
100% Remote
North America

Apply for this Position

See All Their Jobs

Share this job: