Senior Cloud Security Engineer

GitHub is changing the way the world builds software, and we want you to help change the way we secure GitHub. We are looking for an experienced Security Engineer to evolve and advance the cloud security posture of GitHub and its ecosystem.
As a Senior Cloud Security Engineer on the Cloud Security Engineer team, you will work alongside Hubbers across all of GitHub to help drive technical direction for all things cloud security at GitHub. This position combines hands-on security engineering with cross-functional collaboration to establish secure defaults, reduce security risks, and improve the developer's experience.

Cloud Security Engineers at GitHub are self-starters, able to work autonomously in ambiguous environments, and collaborative natural problem solvers with experience automating and integrating disparate technologies. You should have strong problem-solving skills, excellent communication skills, a deep technical understanding of modern cloud and containerized security threats, the ability to influence people from customers to managers through technical solutions, and the desire to be an integral contributor to securing GitHub systems.

• Owns complex technical security initiatives and develops solutions to address identified cloud security issues, taking intended and unintended consequences into account. Operationalizes and scales a program and solution appropriately. Identifies high-priority opportunities and makes data-driven recommendations for efficiencies to improve security posture and proactively prevent attacks. Assists team with understanding the implications of implementing security controls and understanding availability impacts.

• Contributes to and maintains accurate and comprehensive cloud security policy, standards, and best practices that impact teams across the organization. Designs mitigation strategies to address identified gaps in policy. Recommends refinement of security policy, standards and best practices based on evolving threat conditions and industry trends. Creates and implements security controls, and solutions to protect the confidentiality, integrity, and availability of networks, systems, and data.

• Recommends mitigation strategies based on trends identified in the analysis of key metrics, key performance indicators (KPIs), and other data sources (e.g., bugs, unhealthy data pipeline). Defines and implements metrics to address gaps in measurement. Influences others to take action in response to findings, prioritized by severity.

• Identifies and raises opportunities for automation to improve efficiency and effectiveness of security guardrails. Supports development and implementation of new automation. Proactively proposes where investment will yield greatest risk reduction. Develops and implements services and solutions and is dedicated to improving and maintaining these solutions over time.

• Educates and engages with others (e.g., internal teams, external partners) to drive consistency and awareness of security risk, best practices, and standards for the cloud. Translates highly technical and complex information to nontechnical audiences (e.g., leaders, industry partners, internal teams) to effectively communicate security risks. Develops and shares reports with leaders on security risks and remediation strategies used to resolve and drive down security concerns. Collaborates with teams across the organization to address security risks and define new requirements and feature sets. Mentors shares knowledge and help develop the collective knowledge of the team.

Required Qualifications

• 5+ years of working with cloud infrastructure
• 3+ years experience building and managing infrastructure in Microsoft Azure
• 1+ year(s) experience in software development
• 7+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
  • OR Associate's Degree AND 6+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
  • OR Bachelor's Degree AND 5+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
  • OR Master's Degree AND 3+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
  • OR Doctorate AND 1+ year(s) experience in security analysis, security research, cyber security, security engineering, or relevant area 
  • OR equivalent experience.

Preferred Qualifications

• Extensive experience building security solutions, ideally for cloud services 
• Experience building services in Golang (preferred), Python, Terraform and/or Ruby
• Experience with networking in cloud environments and common services used to manage and implement network segmentation
• Experience performing threat modeling and design reviews to assess security implications and requirements for introducing new technologies
• Ability to produce concise and quality technical documentation
• AZ-900, AZ-500, SC-100, SC-500, Hashicorp Terraform Associate, GIAC Cloud Security Essentials Certification (GCLD), GIAC Public Cloud Security (GPCS), GIAC Cloud Security Architecture and Design (GCAD), or other relevant cloud security certifications

• Owns complex technical security initiatives and develops solutions to address identified cloud security issues, taking intended and unintended consequences into account. Operationalizes and scales a program and solution appropriately. Identifies high-priority opportunities and makes data-driven recommendations for efficiencies to improve security posture and proactively prevent attacks. Assists team with understanding the implications of implementing security controls and understanding availability impacts.

• Contributes to and maintains accurate and comprehensive cloud security policy, standards, and best practices that impact teams across the organization. Designs mitigation strategies to address identified gaps in policy. Recommends refinement of security policy, standards and best practices based on evolving threat conditions and industry trends. Creates and implements security controls, and solutions to protect the confidentiality, integrity, and availability of networks, systems, and data.

• Recommends mitigation strategies based on trends identified in the analysis of key metrics, key performance indicators (KPIs), and other data sources (e.g., bugs, unhealthy data pipeline). Defines and implements metrics to address gaps in measurement. Influences others to take action in response to findings, prioritized by severity.

• Identifies and raises opportunities for automation to improve efficiency and effectiveness of security guardrails. Supports development and implementation of new automation. Proactively proposes where investment will yield greatest risk reduction. Develops and implements services and solutions and is dedicated to improving and maintaining these solutions over time.

• Educates and engages with others (e.g., internal teams, external partners) to drive consistency and awareness of security risk, best practices, and standards for the cloud. Translates highly technical and complex information to nontechnical audiences (e.g., leaders, industry partners, internal teams) to effectively communicate security risks. Develops and shares reports with leaders on security risks and remediation strategies used to resolve and drive down security concerns. Collaborates with teams across the organization to address security risks and define new requirements and feature sets. Mentors shares knowledge and help develop the collective knowledge of the team.

Required Qualifications

• 5+ years of working with cloud infrastructure
• 3+ years experience building and managing infrastructure in Microsoft Azure
• 1+ year(s) experience in software development
• 7+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
  • OR Associate's Degree AND 6+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
  • OR Bachelor's Degree AND 5+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
  • OR Master's Degree AND 3+ years experience in security analysis, security research, cyber security, security engineering, or relevant area
  • OR Doctorate AND 1+ year(s) experience in security analysis, security research, cyber security, security engineering, or relevant area 
  • OR equivalent experience.

Preferred Qualifications

• Extensive experience building security solutions, ideally for cloud services 
• Experience building services in Golang (preferred), Python, Terraform and/or Ruby
• Experience with networking in cloud environments and common services used to manage and implement network segmentation
• Experience performing threat modeling and design reviews to assess security implications and requirements for introducing new technologies
• Ability to produce concise and quality technical documentation
• AZ-900, AZ-500, SC-100, SC-500, Hashicorp Terraform Associate, GIAC Cloud Security Essentials Certification (GCLD), GIAC Public Cloud Security (GPCS), GIAC Cloud Security Architecture and Design (GCAD), or other relevant cloud security certifications