Senior Product Security Engineer - Red Team
Posted Apr 19
GitHub is changing the way the world builds secure software and we want you to help change the way we secure GitHub. We're looking for a security engineer to engage in GitHub’s red team operations. GitHub’s Application Security team (AppSec) has historically been focused on collaborating with and supporting engineering teams during the software development lifecycle. We are looking for a fresh perspective to drive the identification and mitigation of security risks from an attacker’s point of view.
Senior Product Security Engineer
In this role you will scope red team engagements, execute offensive operations, and deliver results to key stakeholders. You'll also provide a vital offensive perspective to many security-wide initiatives, including threat modeling, table tops and adversarial analysis. In this position, you'll also work closely with the Product Security Engineering teams to support the secure development and deployment of critical GitHub infrastructure.
Your responsibilities will include:
- Defining processes and initiatives to operate against GitHub’s services and infrastructure, while taking care to minimize impact to systems and data
- Digesting complex application and service architectures to identify potential threats and avenues for exploitation
The minimum qualifications are:
- A passion for identifying and exploiting security vulnerabilities, developing payloads, or building scalable offensive tooling
- 3+ years of experience performing penetration tests, security code reviews, and red team operations
Junior Product Security Engineer
In this role you will support red team engagements, execute offensive operations, and deliver results to key stakeholders. You'll also provide a vital offensive perspective to many security-wide initiatives, including threat modeling, table tops and adversarial analysis. In this position, you'll also work closely with the Product Security Engineering teams to support the secure development and deployment of critical GitHub infrastructure.
Communication and empathy is key in this role, and your collaboration with engineers is just as important as the vulnerabilities and security risks you identify. In this role you’ll not only need to be creative and thorough in the attacks you perform, but also in helping drive the remediation strategies with teams across the company.
Your responsibilities will include:
- Performing offensive operations against GitHub’s services and infrastructure, while taking care to minimize impact to systems and data
- Reviewing basic applications and learning new service architectures to identify potential threats and avenues for exploitation
- Engaging internal engineering and security teams to work with during red team operations
- Collaborating with engineering teams and leadership to communicate identified risks and expectations for remediation
- Mentoring other team members
The minimum qualifications are:
- A passion for identifying and exploiting security vulnerabilities, developing payloads, or building scalable offensive tooling
- 1 year of experience performing penetration tests, security code reviews, and red team operations.
- Experience in security architecture review and threat modeling of complex systems
- Experience developing security testing tooling and exploits
- Experience with identifying and exploiting the unique security risks of cloud computing platforms including Azure and AWS
- Excellent written and verbal communication skills targeting a broad range of audiences from engineers to leadership
- Ability to empathize with a diverse range of engineers
Bonus points if you have:
- Experience with exploiting virtualization technologies and container orchestration systems such as Kubernetes and Nomad
- Practical software development skills with Ruby on Rails or Go
- Experience using Git and GitHub
Minimum salary of 90,700 to maximum 192,400 + bonus + equity + benefits.
Note: Disclosure as required by sb19-085 (8-5-20) of the minimum salary compensation for this role when being hired in Colorado.
Who We Are:
GitHub is the developer company. We make it easier for developers to be developers: to work together, to solve challenging problems, and to create the world’s most important technologies. We foster a collaborative community that can come togetheras individuals and in teamsto create the future of software and make a difference in the world.
Leadership Principles:
Customer Obsessed - Trust by Default - Ship to Learn - Own the Outcome - Growth Mindset - Global Product, Global Team - Anything is Possible - Practice Kindness
Why You Should Join:
At GitHub, we constantly strive to create an environment that allows our employees (Hubbers) to do the best work of their lives. We've designed one of the coolest workspaces in San Francisco (HQ), where many Hubbers work, snack, and create daily. The rest of our Hubbers work remotely around the globe.
We are also committed to keeping Hubbers healthy, motivated, focused and creative. We've designed our top-notch benefits program with these goals in mind. In a nutshell, we've built a place where we truly love working, we think you will too.
GitHub is made up of people from a wide variety of backgrounds and lifestyles. We embrace diversity and invite applications from people of all walks of life. We don't discriminate against employees or applicants based on gender identity or expression, sexual orientation, race, religion, age, national origin, citizenship, disability, pregnancy status, veteran status, or any other differences. Also, if you have a disability, please let us know if there's any way we can make the interview process better for you; we're happy to accommodate!
Please note that benefits vary by country. If you have any questions, please don't hesitate to ask your Talent Partner.
Misc Info For This Position:
Remote Mix: 100% Remote
Position Level: Senior
Job Type: Full-Time
Regional Restrictions: USA Only
