Find work in the United States.

A simpler way to find your next job.

Jobs in the United States

25+ jobs

Save this search

Added 21 hours ago
MGR COMPUTER SYS SECURITY 2 (IAM & APPS)
Huntington Ingalls Industries
Newport News, VA
Designs, tests, and implements state-of-the-art secure operating systems, networks, and database products. Conducts risk assessment and provides recommendations for application design.…
Added 1 day ago
Manager Gas Control & SCADA
Avangrid Service Co
BIBLE SCHOOL PARK, NY
Added 1 day ago
Program Support Specialist 4 - Annapolis Junction, MD
M. C. Dean
Annapolis Junction, MD
M.C. Dean is Building Intelligence®. We design, build, operate, and maintain cyber-physical solutions for the nation’s most mission-critical facilities, secure environments, complex…
Added 1 day ago
Senior SOC Analyst
KeenLogic
Merrifield, VA
…the following cybersecurity- related functions; information security, SPAA, incident response, cyber security, insider threat, computer forensics, vulnerability assessment and management,…
Added 1 day ago
Senior Cyber Security Administrator
ASRC Federal
Huntsville, AL
ASRC Federal System Solutions, LLC. (AFSS), a subsidiary of ASRC Federal, is a premier provider of systems engineering, software engineering, system integration and project management…
Added 2 days ago
TM
Network Engineer (Network Engineering, Associate)
The MIL Corporation
Lexington Park, MD
- $100,847 to $120,000 USD / year
The MIL Corporation is seeking a Network Engineer (Network Engineering, Associate) to support a Federal Government client at our Lexington Park, MD location. The Network Engineer will…
Added 2 days ago
Associate Director of Cybersecurity
FirstDay Foundation
San Antonio, TX
This role serves as the operational bridge between executive priorities and the Cyber Security team’s daily execution: translating direction into clear priorities, assigning accountable…
Added 2 days ago
Physical Infrastructure Engineer - Senior
Amentum
Fort Meade, MD
Are you interested in using your skills to help shape the Cyber, Security, & Intel space? If so, look no further. Amentum is seeking a Physical Infrastructure Engineer, Senior to join our…
Added 2 days ago
Physical Infrastructure Engineer - Senior
Amentum
Fort Meade, MD
Are you interested in using your skills to help shape the Cyber, Security, & Intel space? If so, look no further. Amentum is seeking a Physical Infrastructure Engineer, Senior to join our…
Added 2 days ago
Cybersecurity Analyst (48387)
CHARLOTTE EYE EAR NOSE AND THROAT ASSOCIATES PA
Huntersville, NC
…responsible for supporting daily cybersecurity operations, security monitoring, incident triage, documentation, risk and compliance activities, and end-user security support. The role works…
Added 2 days ago
Cleared Senior/Principal Cyber Information System Security Officer (ISSO), Onsite
Sandia National Laboratories
Albuquerque, NM
This individual will be assigned the role of Information System Security Officer (ISSO) for multiple information systems, configure and maintain cybersecurity tools, and will work closely…
Added 2 days ago
Cloud Security Manager - Azure Infrastructure & AI
Deloitte
Kansas City, MO
As a Cloud Security Manager on the Cloud Cyber Risk team, you will be responsible for:
Added 2 days ago
Controls Technician - Nights
Mars Petcare US, Inc.
United States
Responsibilities include supporting the Engineering Manager on Capital projects and developing Reliability Technicians. Key concepts of the role include, but are not limited to, developing…
Added 2 days ago
Senior Associate, Project Manager - Commercial Digital Banking Well-Managed Team
Capital One
McLean, VA · Charlotte, NC · Richmond, VA
…management and maintenance, fraud, business operations, and cyber/security…
Added 2 days ago
NJ
Information Technology Analyst 3 - Engineering
New Jersey Courts
Trenton, NJ
- $94,668.29 to $133,073.24 USD / year
Under the direction of the Chief Information Security Officer (CISO), this position will report to the Manager for Engineering and Project Development and will also work closely with the…
Added 2 days ago
SecOps Modernization & Agentic SOC Sr Manager
Accenture
Saint Louis, MO
Accenture Security helps organizations prepare, protect, detect, respond to, and recover, at all points of the security lifecycle. We hire the very best security talent and arm them with…
Added 2 days ago
Associate Manager, Operations Management
L3Harris
Camden, NJ
…technology solutions connecting the space, air, land, sea and cyber domains in the interest of national…
Added 2 days ago
Senior Associate, Project Manager - Commercial Digital Banking Well Managed Team
Capital One
McLean, VA · Richmond, VA
…management and maintenance, fraud, business operations, and cyber/security…
Added 2 days ago
A
SecOps Modernization & Agentic SOC Manager
Accenture
Saint Louis, MO
- $94,400 to $293,800 USD / year
Manager will also contribute to the development of the security operations modernization offerings assets, accelerators, and methodologies to differentiate Accenture Cyber Security. They…
Added 2 days ago
DevOps Engineer
KBR
Colorado Springs, CO
KBR’s National Security Solutions team provides high-end engineering and advanced technology solutions to our customers in the intelligence and national security communities.
Added 2 days ago
GI
Staff Manager, Product Security Response
GitHub, Inc.
United States
- $144,600 to $383,500 USD / year
o OR Associate's Degree AND 9+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
Added 3 days ago
Windows Client Engineer, RSCI Collaborative Services
Amazon Development Center U.S., Inc.
Jessup, MD · Bellevue, WA · Seattle, WA · Herndon, VA
- Security compliance including hardening OS, managing patching (Windows Server Update Services (WSUS)/Endpoint Configuration Manager (ECM)), and maintaining vulnerability SLAs
Added 3 days ago
Full Stack Engineering Manager
Lockheed Martin
Colorado Springs, CO
The Tech Refresh will focus on Foundational / Cyber Security Enhancements. Join us and become a part of the team that is actively designing and developing the updated baseline and get the…
Added 3 days ago
Full Stack Engineering Manager/ IPT Lead
Lockheed Martin
Colorado Springs, CO
The Tech Refresh will focus on Foundational / Cyber Security Enhancements. Join us and become a part of the team that is actively designing and developing the updated baseline and get the…
Added 3 days ago
A
AI - Cybersecurity Forward Deployed Engineer - FDE Senior Manager
Accenture
Nashville, TN
- $132,500 to $366,300 USD / year
This is not a security consulting role. It is not a compliance advisory position. It is not a pen test engagement. A Cybersecurity Forward Deployed Engineer is a production engineer who…

GitHub, Inc.

Staff Manager, Product Security Response

United States

$144,600 to $383,500 USD / year

Apply About employer

Applications open in a new tab.

Job details

Pay: $144,600 to $383,500 USD / year
Posting language: English
Posted: Nov 5, 2026

Original job description

About GitHub

GitHub is the world’s leading platform for agentic software development - powered by Copilot to build, scale, and deliver secure software. Over 180 million developers, including more than 90% of the Fortune 100 companies, use GitHub to collaborate, and more than 77,000 organisations have adopted GitHub Copilot.

Locations

In this role you can work from Remote, United States

Overview

GitHub is transforming how the world builds secure software, and we are looking for a Staff Manager, Product Security Response to lead the team responsible for the last line of defense once vulnerabilities reach GitHub's shipped products: our Product Security Incident Response Team (PSIRT) .

This is a people-management role at the center of GitHub's vulnerability response posture. You will lead an 8-person team covering first-party vulnerability triage and remediation coordination, CVE/CNA operations, and external researcher engagement through HackerOne. You will set the strategy, staffing model, and operational rigor that keeps incident response sustainable as both incident volume and bug bounty submission volume continue to grow sharply year over year, while partnering closely with Legal/CELA, Security Comms, and Microsoft's MSRC to keep scope boundaries clean and response execution credible to regulators and partners.

Responsibilities

Establish and defend the accountabilities, staffing model, and on-call rotation health for PSIRT , ensuring both teams can sustainably execute incident response and researcher-facing commitments without relying on heroics.
Own the PSIRT charter and scope boundary relative to ProdSec Services, CSIRT/SIRT, Legal/CELA, and Security Comms, and hold the line on that boundary as adjacent functions try to route work back to PSIRT by default.
Drive the CVE/CNA program, including expansion to cover cloud products, and own GitHub's direct relationship with the external security researcher community.
Lead incident response for first-party vulnerability disclosures: triage, technical assessment, remediation coordination with Engineering, and lightweight command for time-sensitive vulnerability management.
Define and drive the team's key metrics and KPIs (triage-to-handoff time, backlog aging, containment speed, bug bounty resolution SLA), using them to identify trends and direct where investment and process changes are needed.
Translate highly technical, often embargoed or TLP-marked vulnerability information into clear guidance for non-technical stakeholders, including executive and regulatory audiences.
Partner with Legal/CELA, Security Comms, and Microsoft's MSRC to resolve ownership ambiguity at the edges of PSIRT's scope (regulatory notification, coordinated disclosure, customer communications), rather than letting it default to PSIRT by inertia.
Manage people: hire, develop, and performance-manage a team of security engineers and researchers; lead through active workforce situations (coverage gaps, performance management, attrition risk) with the same rigor applied to technical incident response.

Qualifications

Required Qualifications:

10+ years experience in security analysis, security research, cyber security, security engineering, or relevant area o OR Associate's Degree AND 9+ years experience in security analysis, security research, cyber security, security engineering, or relevant area o OR Bachelor's Degree AND 8+ years experience in security analysis, security research, cyber security, security engineering, or relevant area o OR Master's Degree AND 6+ years experience in security analysis, security research, cyber security, security engineering, or relevant area o OR Doctorate AND 4+ years experience in security analysis, security research, cyber security, security engineering, or relevant area o OR equivalent experience
2+ years people management experience.
2+ years of direct experience in product security incident response or vulnerability management, including coordinating remediation across engineering teams under time pressure.
2+ years experience with CVE/CNA operations and direct engagement with the external security researcher community.

Preferred Qualifications:

2+ years leading a Product Security Incident Response Team (PSIRT), CSIRT, SOC, or comparable vulnerability-management function.
2+ years experience leading multi-disciplinary teams across engineering, legal, and communications functions.
Experience navigating regulatory notification requirements (e.g., FedRAMP) and partnering with Legal/CELA on disclosure obligations.
Certified Information Systems Security Professional (CISSP), GIAC Certified Incident Handler (GCIH), or other relevant certification.
1+ year(s) experience working with GitHub and/or open source software.
Familiarity with GitHub's products, platform, and developer ecosystem.

Compensation Range

The base salary range for this job is USD $144,600.00 - USD $383,500.00 /Yr.

These pay ranges are intended to cover roles based across the United States. An individual's base pay depends on various factors including geographical location and review of experience, knowledge, skills, abilities of the applicant. At GitHub certain roles are eligible for benefits and additional rewards, including annual bonus and stock. These rewards are allocated based on individual impact in role. In addition, certain roles also have the opportunity to earn sales incentives based on revenue or utilization, depending on the terms of the plan and the employee's role.

This position will be open for a minimum of 3 days, with applications accepted on an ongoing basis until the position is filled.

GitHub values

Customer-obsessed
Ship to learn
Growth mindset
Own the outcome
Better together
Diverse and inclusive

Manager fundamentals

Model
Coach
Care

Leadership principles

Create clarity
Generate energy
Deliver success

Who We Are

GitHub is the world’s leading AI-powered developer platform with 150 million developers and counting. We’re also home to the biggest open-source community on earth (and 99% of the world’s software has open-source code in its DNA). Many of the apps and programs you use every day are built on GitHub.

Our teams are dreamers, doers, and pioneers, leading the way in AI, driving humanitarian efforts around the globe, and even sending open source to Mars (and beyond!). At GitHub, our goal is to create the space you need to do your best work. We’re remote-first and offer competitive pay, generous learning and growth opportunities, and excellent benefits to support you, wherever you are - because we know that people flourish when they can work on their own terms.

Join us, and let’s change the world, together.

EEO Statement

GitHub is made up of people from a wide variety of backgrounds and lifestyles. We embrace diversity and invite applications from people of all walks of life. We don't discriminate against employees or applicants based on gender identity or expression, sexual orientation, race, religion, age, national origin, citizenship, disability, pregnancy status, veteran status, or any other differences. Also, if you have a disability, please let us know if there's any way we can make the interview process better for you; we're happy to accommodate!

Establish and defend the accountabilities, staffing model, and on-call rotation health for PSIRT , ensuring both teams can sustainably execute incident response and researcher-facing commitments without relying on heroics.
Own the PSIRT charter and scope boundary relative to ProdSec Services, CSIRT/SIRT, Legal/CELA, and Security Comms, and hold the line on that boundary as adjacent functions try to route work back to PSIRT by default.
Drive the CVE/CNA program, including expansion to cover cloud products, and own GitHub's direct relationship with the external security researcher community.
Lead incident response for first-party vulnerability disclosures: triage, technical assessment, remediation coordination with Engineering, and lightweight command for time-sensitive vulnerability management.
Define and drive the team's key metrics and KPIs (triage-to-handoff time, backlog aging, containment speed, bug bounty resolution SLA), using them to identify trends and direct where investment and process changes are needed.
Translate highly technical, often embargoed or TLP-marked vulnerability information into clear guidance for non-technical stakeholders, including executive and regulatory audiences.
Partner with Legal/CELA, Security Comms, and Microsoft's MSRC to resolve ownership ambiguity at the edges of PSIRT's scope (regulatory notification, coordinated disclosure, customer communications), rather than letting it default to PSIRT by inertia.
Manage people: hire, develop, and performance-manage a team of security engineers and researchers; lead through active workforce situations (coverage gaps, performance management, attrition risk) with the same rigor applied to technical incident response.

Required Qualifications:

10+ years experience in security analysis, security research, cyber security, security engineering, or relevant area o OR Associate's Degree AND 9+ years experience in security analysis, security research, cyber security, security engineering, or relevant area o OR Bachelor's Degree AND 8+ years experience in security analysis, security research, cyber security, security engineering, or relevant area o OR Master's Degree AND 6+ years experience in security analysis, security research, cyber security, security engineering, or relevant area o OR Doctorate AND 4+ years experience in security analysis, security research, cyber security, security engineering, or relevant area o OR equivalent experience
2+ years people management experience.
2+ years of direct experience in product security incident response or vulnerability management, including coordinating remediation across engineering teams under time pressure.
2+ years experience with CVE/CNA operations and direct engagement with the external security researcher community.

Preferred Qualifications:

2+ years leading a Product Security Incident Response Team (PSIRT), CSIRT, SOC, or comparable vulnerability-management function.
2+ years experience leading multi-disciplinary teams across engineering, legal, and communications functions.
Experience navigating regulatory notification requirements (e.g., FedRAMP) and partnering with Legal/CELA on disclosure obligations.
Certified Information Systems Security Professional (CISSP), GIAC Certified Incident Handler (GCIH), or other relevant certification.
1+ year(s) experience working with GitHub and/or open source software.
Familiarity with GitHub's products, platform, and developer ecosystem.

Apply About employer

Report this job