Product Security Incident Response Analyst

Develop and Operationalize Solutions: 

● Develop and implement solutions to address product security incidents across all GitHub Products, ensuring scalability and effectiveness. 

● Utilize advanced data analysis and forensics techniques to investigate, scope and resolve product security incidents. 

● Continuously improve incident response processes and solutions over time. 

Automation: 

● Identify and implement automation opportunities to enhance efficiency and effectiveness in incident response operations. 

● Develop and maintain automation scripts and tools to streamline response processes and case management. 

● Collaborate with others to prioritize and invest in the most valuable automation opportunities.  

Collaboration: 

● Engage with internal teams and external partners to promote security risk awareness and best practices. 

● Translate complex technical information into understandable terms for nontechnical audiences, effectively communicating security risks. 

● Develop and share reports with leaders on security risks and remediation strategies to resolve and mitigate security concerns. 

● Collaborate with architecture teams to integrate security into the design and development of systems and applications, ensuring robust security frameworks are in place from the ground up. 

Data-Driven Analysis and Forensics: 

● Analyze key metrics and key performance indicators (KPIs) to identify trends in product security incidents and escalate appropriately. 

● Utilize multiple data sources to conduct and interpret analysis, identifying anomalies and patterns in security data. 

● Leverage forensics techniques to investigate, scope and resolve product security incidents, ensuring thorough and accurate analysis. 

● Recommend improvements and metrics to address gaps in telemetry, measurement and enhance incident response capabilities. 

Incident Response Activities: 

● Participate in product security incident response activities, leveraging technical acumen to address and resolve security concerns effectively. 

● Recognize patterns and trends to propose innovative solutions for security improvements, contributing to a culture of continuous enhancement and excellence. 

● Ensure compliance with relevant security regulations and standards, conducting risk assessments and audits to identify and address potential compliance gaps. 

● Coordinate communications and manage stakeholder engagement during product security incidents, ensuring timely, clear updates, and draft and publish CVEs in coordination with relevant teams and partners. 

● 7+ years experience in product security, security analysis, security research, cyber security, security engineering, or relevant area 

o OR Associate's Degree AND 6+ years experience in security analysis, security research, cyber security, security engineering, or relevant area 

o OR Bachelor's Degree AND 5+ years experience in security analysis, security research, cyber security, security engineering, or relevant area 

o OR Master's Degree AND 3+ years experience in security analysis, security research, cyber security, security engineering, or relevant area 

o OR Doctorate AND 1+ year(s) experience in security analysis, security research, cyber security, security engineering, or relevant area 

o OR equivalent experience. 

● 1+ year(s) experience investigating software product vulnerabilities within the development lifecycle using application security tools (SAST, DAST, SCA) and/or performing threat modeling, security design and architecture review, application security testing, and code review, with hands-on involvement in assessing product impact and collaborating with engineering teams to remediate findings. 

● 1+ years’ experience working with GitHub and/or other open-source software platforms.