[Hiring] Staff Manager, Product Security Response @GitHub, Inc.

Role Description

GitHub is transforming how the world builds secure software, and we are looking for a Staff Manager, Product Security Response to lead the team responsible for the last line of defense once vulnerabilities reach GitHub's shipped products: our Product Security Incident Response Team (PSIRT).

This is a people-management role at the center of GitHub's vulnerability response posture. You will lead an 8-person team covering:

• First-party vulnerability triage and remediation coordination
• CVE/CNA operations
• External researcher engagement through HackerOne

You will set the strategy, staffing model, and operational rigor that keeps incident response sustainable as both incident volume and bug bounty submission volume continue to grow sharply year over year, while partnering closely with Legal/CELA, Security Comms, and Microsoft's MSRC.

Responsibilities

• Establish and defend the accountabilities, staffing model, and on-call rotation health for PSIRT.
• Own the PSIRT charter and scope boundary relative to ProdSec Services, CSIRT/SIRT, Legal/CELA, and Security Comms.
• Drive the CVE/CNA program, including expansion to cover cloud products.
• Lead incident response for first-party vulnerability disclosures: triage, technical assessment, remediation coordination with Engineering.
• Define and drive the team's key metrics and KPIs (triage-to-handoff time, backlog aging, containment speed, bug bounty resolution SLA).
• Translate highly technical vulnerability information into clear guidance for non-technical stakeholders.
• Partner with Legal/CELA, Security Comms, and Microsoft's MSRC to resolve ownership ambiguity.
• Manage people: hire, develop, and performance-manage a team of security engineers and researchers.

Qualifications

• 10+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
• OR Associate's Degree AND 9+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
• OR Bachelor's Degree AND 8+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
• OR Master's Degree AND 6+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
• OR Doctorate AND 4+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
• OR equivalent experience
• 2+ years people management experience.
• 2+ years of direct experience in product security incident response or vulnerability management.
• 2+ years experience with CVE/CNA operations and direct engagement with the external security researcher community.

Preferred Qualifications

• 2+ years leading a Product Security Incident Response Team (PSIRT), CSIRT, SOC, or comparable vulnerability-management function.
• 2+ years experience leading multi-disciplinary teams across engineering, legal, and communications functions.
• Experience navigating regulatory notification requirements (e.g., FedRAMP).
• Certified Information Systems Security Professional (CISSP), GIAC Certified Incident Handler (GCIH), or other relevant certification.
• 1+ year(s) experience working with GitHub and/or open source software.
• Familiarity with GitHub's products, platform, and developer ecosystem.

Compensation Range

The base salary range for this job is USD $144,600.00 - USD $383,500.00 /Yr. These pay ranges are intended to cover roles based across the United States. An individual's base pay depends on various factors including geographical location and review of experience, knowledge, skills, abilities of the applicant.

EEO Statement

GitHub is made up of people from a wide variety of backgrounds and lifestyles. We embrace diversity and invite applications from people of all walks of life. We don't discriminate against employees or applicants based on gender identity or expression, sexual orientation, race, religion, age, national origin, citizenship, disability, pregnancy status, veteran status, or any other differences.