Senior Cloud Security Engineer

About GitHub

GitHub is the world’s leading platform for agentic software development - powered by Copilot to build, scale, and deliver secure software. Over 180 million developers, including more than 90% of the Fortune 100 companies, use GitHub to collaborate, and more than 77,000 organisations have adopted GitHub Copilot.

Locations

In this role you can work from Remote, United States

Overview

GitHub is changing the way the world builds software, and we want you to help change the way we secure GitHub. We are looking for an experienced Security Engineer to evolve and advance the cloud security posture of GitHub and its ecosystem.

As a Senior Cloud Security Engineer on the Cloud Security Engineer team, you will work alongside Hubbers across all of GitHub to help drive technical direction for all things cloud security at GitHub. This position combines hands-on security engineering with cross-functional collaboration to establish secure defaults, reduce security risks, and improve the developer's experience.

Cloud Security Engineers at GitHub are self-starters, able to work autonomously in ambiguous environments, and collaborative natural problem solvers with experience automating and integrating disparate technologies. You should have strong problem-solving skills, excellent communication skills, a deep technical understanding of modern cloud and containerized security threats, the ability to influence people from customers to managers through technical solutions, and the desire to be an integral contributor to securing GitHub systems.

Responsibilities

• Owns complex technical security initiatives and develops solutions to address identified cloud security issues, taking intended and unintended consequences into account. Operationalizes and scales a program and solution appropriately. Identifies high-priority opportunities and makes data-driven recommendations for efficiencies to improve security posture and proactively prevent attacks. Assists team with understanding the implications of implementing security controls and understanding availability impacts.
• Contributes to and maintains accurate and comprehensive cloud security policy, standards, and best practices that impact teams across the organization. Designs mitigation strategies to address identified gaps in policy. Recommends refinement of security policy, standards and best practices based on evolving threat conditions and industry trends. Creates and implements security controls, and solutions to protect the confidentiality, integrity, and availability of networks, systems, and data.
• Recommends mitigation strategies based on trends identified in the analysis of key metrics, key performance indicators (KPIs), and other data sources (e.g., bugs, unhealthy data pipeline). Defines and implements metrics to address gaps in measurement. Influences others to take action in response to findings, prioritized by severity.
• Identifies and raises opportunities for automation to improve efficiency and effectiveness of security guardrails. Supports development and implementation of new automation. Proactively proposes where investment will yield greatest risk reduction. Develops and implements services and solutions and is dedicated to improving and maintaining these solutions over time.
• Educates and engages with others (e.g., internal teams, external partners) to drive consistency and awareness of security risk, best practices, and standards for the cloud. Translates highly technical and complex information to nontechnical audiences (e.g., leaders, industry partners, internal teams) to effectively communicate security risks. Develops and shares reports with leaders on security risks and remediation strategies used to resolve and drive down security concerns. Collaborates with teams across the organization to address security risks and define new requirements and feature sets. Mentors shares knowledge and help develop the collective knowledge of the team.

Qualifications

Required Qualifications

• 5+ years of working with cloud infrastructure
• 3+ years experience building and managing infrastructure in Microsoft Azure
• 1+ year(s) experience in software development
• 7+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
• OR Associate's Degree AND 6+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
• OR Bachelor's Degree AND 5+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
• OR Master's Degree AND 3+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
• OR Doctorate AND 1+ year(s) experience in security analysis, security research, cyber security, security engineering, or relevant area
• OR equivalent experience.

Preferred Qualifications

• Extensive experience building security solutions, ideally for cloud services
• Experience building services in Golang (preferred), Python, Terraform and/or Ruby
• Experience with networking in cloud environments and common services used to manage and implement network segmentation
• Experience performing threat modeling and design reviews to assess security implications and requirements for introducing new technologies
• Ability to produce concise and quality technical documentation
• AZ-900, AZ-500, SC-100, SC-500, Hashicorp Terraform Associate, GIAC Cloud Security Essentials Certification (GCLD), GIAC Public Cloud Security (GPCS), GIAC Cloud Security Architecture and Design (GCAD), or other relevant cloud security certifications

Compensation Range

The base salary range for this job is USD $127,800.00 - USD $339,000.00 /Yr.

These pay ranges are intended to cover roles based across the United States. An individual's base pay depends on various factors including geographical location and review of experience, knowledge, skills, abilities of the applicant. At GitHub certain roles are eligible for benefits and additional rewards, including annual bonus and stock. These rewards are allocated based on individual impact in role. In addition, certain roles also have the opportunity to earn sales incentives based on revenue or utilization, depending on the terms of the plan and the employee's role.

This position will be open for a minimum of 3 days, with applications accepted on an ongoing basis until the position is filled.

GitHub values

• Customer-obsessed
• Ship to learn
• Growth mindset
• Own the outcome
• Better together
• Diverse and inclusive

Manager fundamentals

• Model
• Coach
• Care

Leadership principles

• Create clarity
• Generate energy
• Deliver success

Who We Are

GitHub is the world’s leading AI-powered developer platform with 150 million developers and counting. We’re also home to the biggest open-source community on earth (and 99% of the world’s software has open-source code in its DNA). Many of the apps and programs you use every day are built on GitHub.

Our teams are dreamers, doers, and pioneers, leading the way in AI, driving humanitarian efforts around the globe, and even sending open source to Mars (and beyond!). At GitHub, our goal is to create the space you need to do your best work. We’re remote-first and offer competitive pay, generous learning and growth opportunities, and excellent benefits to support you, wherever you are - because we know that people flourish when they can work on their own terms.

Join us, and let’s change the world, together.

EEO Statement

GitHub is made up of people from a wide variety of backgrounds and lifestyles. We embrace diversity and invite applications from people of all walks of life. We don't discriminate against employees or applicants based on gender identity or expression, sexual orientation, race, religion, age, national origin, citizenship, disability, pregnancy status, veteran status, or any other differences. Also, if you have a disability, please let us know if there's any way we can make the interview process better for you; we're happy to accommodate!

• Owns complex technical security initiatives and develops solutions to address identified cloud security issues, taking intended and unintended consequences into account. Operationalizes and scales a program and solution appropriately. Identifies high-priority opportunities and makes data-driven recommendations for efficiencies to improve security posture and proactively prevent attacks. Assists team with understanding the implications of implementing security controls and understanding availability impacts.
• Contributes to and maintains accurate and comprehensive cloud security policy, standards, and best practices that impact teams across the organization. Designs mitigation strategies to address identified gaps in policy. Recommends refinement of security policy, standards and best practices based on evolving threat conditions and industry trends. Creates and implements security controls, and solutions to protect the confidentiality, integrity, and availability of networks, systems, and data.
• Recommends mitigation strategies based on trends identified in the analysis of key metrics, key performance indicators (KPIs), and other data sources (e.g., bugs, unhealthy data pipeline). Defines and implements metrics to address gaps in measurement. Influences others to take action in response to findings, prioritized by severity.
• Identifies and raises opportunities for automation to improve efficiency and effectiveness of security guardrails. Supports development and implementation of new automation. Proactively proposes where investment will yield greatest risk reduction. Develops and implements services and solutions and is dedicated to improving and maintaining these solutions over time.
• Educates and engages with others (e.g., internal teams, external partners) to drive consistency and awareness of security risk, best practices, and standards for the cloud. Translates highly technical and complex information to nontechnical audiences (e.g., leaders, industry partners, internal teams) to effectively communicate security risks. Develops and shares reports with leaders on security risks and remediation strategies used to resolve and drive down security concerns. Collaborates with teams across the organization to address security risks and define new requirements and feature sets. Mentors shares knowledge and help develop the collective knowledge of the team.

Required Qualifications

• 5+ years of working with cloud infrastructure
• 3+ years experience building and managing infrastructure in Microsoft Azure
• 1+ year(s) experience in software development
• 7+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
• OR Associate's Degree AND 6+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
• OR Bachelor's Degree AND 5+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
• OR Master's Degree AND 3+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
• OR Doctorate AND 1+ year(s) experience in security analysis, security research, cyber security, security engineering, or relevant area
• OR equivalent experience.

Preferred Qualifications

• Extensive experience building security solutions, ideally for cloud services
• Experience building services in Golang (preferred), Python, Terraform and/or Ruby
• Experience with networking in cloud environments and common services used to manage and implement network segmentation
• Experience performing threat modeling and design reviews to assess security implications and requirements for introducing new technologies
• Ability to produce concise and quality technical documentation
• AZ-900, AZ-500, SC-100, SC-500, Hashicorp Terraform Associate, GIAC Cloud Security Essentials Certification (GCLD), GIAC Public Cloud Security (GPCS), GIAC Cloud Security Architecture and Design (GCAD), or other relevant cloud security certifications