Senior Risk Analyst

United States

Get future jobs matching this search

or

About Git Hub

Git Hub is the world’s leading platform for agentic software development — powered by Copilot to build, scale, and deliver secure software. Over 180 million developers, including more than 90% of the Fortune 100 companies, use Git Hub to collaborate, and more than 77,000 organisations have adopted Git Hub Copilot.

Locations

In this role you can work from Remote, United States

Git Hub is seeking a detail-oriented individual contributor with a technical bent and experience in technical risk management who is driven to deepen that expertise. Git Hub is committed to doing right by our customers and developing a highly effective control environment where risk is managed in a meaningful and sensible way that aligns with our business.

Do you love the challenge of diving into the details and learning why and how things work?

Do you find yourself always asking what would have to go wrong, and how badly?

Do you want to see The Big Picture, and find ways to collect and organize data to tell the story?

Do you suffer from a compulsive need to document things and “get it down on paper”?

And last, but most certainly not least, have you already answered the question “Why are we here?” with the GRC Truth, “Because Customers”?

If so, you might be the person we are looking for!

• Lead security capability risk assessments for assigned areas, including scoping against NIST CSF subcategories, coordinating schedules and stakeholder interviews, completing maturity scoring, and publishing assessment reports.
• Analyze data from multiple sources to identify, analyze, and prioritize technical risks, develop and quantify FAIR-style cyber risk scenarios, evaluate capabilities against established frameworks, and assess potential impacts to Git Hub – our products, services, customers, and business objectives.
• Partner with engineering, security, and product subject-matter experts and leaders to validate findings, identify risk patterns, and translate technical insights and stakeholder feedback into practical risk recommendations.
• Develop and manage risk treatment plans, drive adoption of appropriate mitigations and remediation, monitor treatment progress, and elevate unresolved or emerging risks.
• Maintain the risk register and supporting records in Git Hub’s GRC system of record, track mitigation progress, and provide clear, recurring risk updates to technical and non-technical leaders.

Minimum Qualifications:

• 7+ years experience in security analysis, security research, cyber security, security engineering, software engineering, or relevant area;
• OR Associate's Degree AND 6+ years experience in security analysis, security research, cyber security, security engineering, software engineering, or relevant area
• OR Bachelor's Degree AND 5+ years experience in security analysis, security research, cyber security, security engineering, software engineering, or relevant area
• OR Master's Degree AND 3+ years experience in security analysis, security research, cyber security, security engineering, software engineering, or relevant area
• OR Doctorate AND 1+ year(s) experience in security analysis, security research, cyber security, security engineering, software engineering, or relevant area
• OR equivalent experience.
• 5+ years experience applying security or control frameworks, such as NIST CSF, NIST SP 800-53, or ISO/IEC 27001.
• 5+ years experience in technical risk management, information security, audit, or compliance.

Preferred Qualifications:

• Experience applying cyber risk quantification (CRQ) using FAIR or a comparable quantitative risk analysis method, including…