Staff Manager, Product Security Response

United States

Security

Director

Yes

Full Time

Git Hub is the world’s leading platform for agentic software development — powered by Copilot to build, scale, and deliver secure software. Over 180 million developers, including more than 90% of the Fortune 100 companies, use Git Hub to collaborate, and more than 77,000 organisations have adopted Git Hub Copilot.

In this role you can work from Remote, United States

Git Hub is transforming how the world builds secure software, and we are looking for a Staff Manager, Product Security Response to lead the team responsible for the last line of defense once vulnerabilities reach Git Hub's shipped products: our Product Security Incident Response Team (PSIRT) .

This is a people-management role at the center of Git Hub's vulnerability response posture. You will lead an 8-person team covering first-party vulnerability triage and remediation coordination, CVE/CNA operations, and external researcher engagement through Hacker One. You will set the strategy, staffing model, and operational rigor that keeps incident response sustainable as both incident volume and bug bounty submission volume continue to grow sharply year over year, while partnering closely with Legal/CELA, Security Comms, and Microsoft's MSRC to keep scope boundaries clean and response execution credible to regulators and partners.

• Establish and defend the accountabilities, staffing model, and on-call rotation health for PSIRT , ensuring both teams can sustainably execute incident response and researcher-facing commitments without relying on heroics.
• Own the PSIRT charter and scope boundary relative to Prod Sec Services, CSIRT/SIRT, Legal/CELA, and Security Comms, and hold the line on that boundary as adjacent functions try to route work back to PSIRT by default.
• Drive the CVE/CNA program, including expansion to cover cloud products, and own Git Hub's direct relationship with the external security researcher community.
• Lead incident response for first-party vulnerability disclosures: triage, technical assessment, remediation coordination with Engineering, and lightweight command for time-sensitive vulnerability management.
• Define and drive the team's key metrics and KPIs (triage-to-handoff time, backlog aging, containment speed, bug bounty resolution SLA), using them to identify trends and direct where investment and process changes are needed.
• Translate highly technical, often embargoed or TLP-marked vulnerability information into clear guidance for non-technical stakeholders, including executive and regulatory audiences.
• Partner with Legal/CELA, Security Comms, and Microsoft's MSRC to resolve ownership ambiguity at the edges of PSIRT's scope (regulatory notification, coordinated disclosure, customer communications), rather than letting it default to PSIRT by inertia.
• Manage people: hire, develop, and performance-manage a team of security engineers and researchers; lead through active workforce situations (coverage gaps, performance management, attrition risk) with the same rigor applied to technical incident response.

• 10+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
• OR Associate's Degree AND 9+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
• OR Bachelor's Degree AND 8+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
• OR Master's Degree AND 6+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
• OR Doctorate AND 4+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
• OR equivalent experience
• 2+ years people management experience.
• 2+ years of direct experience in product security incident response or vulnerability management, including coordinating remediation across engineering teams under time pressure.
• 2+ years experience with CVE/CNA operations and direct engagement with the external security researcher community.

• 2+ years leading a Product Security Incident Response Team (PSIRT), CSIRT, SOC, or comparable vulnerability-management function.
• 2+ years experience leading multi-disciplinary teams across engineering, legal, and communications functions.
• Experience…