Note: The job is a remote job and is open to candidates in USA. GitHub is a leading platform for agentic software development and secure software delivery. The Product Security Engineer III will build and maintain internal security platforms, tooling, and automation, including static analysis pipelines, supply chain defenses, and developer-integrated security controls. The role partners with product and engineering teams to improve security at scale.
Responsibilities
- Design, build, and maintain security tooling and automation, including static analysis pipelines, secret scanning workflows, and dependency analysis systems
- Contribute to scalable solutions that reduce recurring vulnerability patterns, focusing on preventing classes of vulnerabilities rather than addressing individual instances
- Build and improve agentic security tooling for automated triage, assessment, and remediation of security findings
- Develop security libraries, CI/CD integrations, and developer-facing tools that make the secure path the default path for engineering teams
- Contribute to supply chain security defenses, building detection and prevention systems that protect GitHub's software supply chain
- Collaborate with teams across the organization to address security risks and define new requirements and feature sets
- Analyze key metrics and KPIs to identify trends in security issues, evaluate the effectiveness of security tooling and automation, and recommend improvements to address gaps in measurement
Skills
- 5+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
- Associate's Degree in a related field AND 4+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
- Bachelor's Degree in a related field AND 3+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
- Master's Degree in a related field AND 1+ year(s) experience in security analysis, security research, cyber security, security engineering, or relevant area
- Equivalent experience
- 1+ year(s) of experience in building security tooling and implementing solutions in complex environments
- 3+ years experience programming in at least 2 of these 3 coding languages: Ruby, Go, Python
- Experience with static analysis tools (SAST/DAST), code scanning frameworks, or custom rule authoring
- Experience building agentic or AI-driven security tooling (e.g., automated triage, classification, or remediation)
- Familiarity with software supply chain security concepts and tooling
- Experience working in large-scale monolith or distributed service codebases
- Familiarity with GitHub's products, platform, and developer ecosystem
- Strong expertise in security principles, including the Security Development Lifecycle (SDL), and experience in vulnerability management
Benefits
- At GitHub certain roles are eligible for benefits and additional rewards, including annual bonus and stock.
- Certain roles also have the opportunity to earn sales incentives based on revenue or utilization, depending on the terms of the plan and the employee's role.
- In this role you can work from Remote, United States.
- GitHub is remote-first.
- Generous learning and growth opportunities.
Company Overview
Company H1B Sponsorship