Senior Risk Analyst, Github

• GitHub is seeking a detail-oriented individual contributor with a technical bent and experience in technical risk management who is driven to deepen that expertise. GitHub is committed to doing right by our customers and developing a highly effective control environment where risk is managed in a meaningful and sensible way that aligns with our business
• Do you love the challenge of diving into the details and learning why and how things work?
• Do you find yourself always asking what would have to go wrong, and how badly?
• Do you want to see The Big Picture, and find ways to collect and organize data to tell the story?
• Do you suffer from a compulsive need to document things and “get it down on paper”?
• And last, but most certainly not least, have you already answered the question “Why are we here?” with the GRC Truth, “Because Customers”?
• 7+ years experience in security analysis, security research, cyber security, security engineering, software engineering, or relevant area
• OR Associate's Degree AND 6+ years experience in security analysis, security research, cyber security, security engineering, software engineering, or relevant area
• OR Bachelor's Degree AND 5+ years experience in security analysis, security research, cyber security, security engineering, software engineering, or relevant area
• OR Master's Degree AND 3+ years experience in security analysis, security research, cyber security, security engineering, software engineering, or relevant area
• OR Doctorate AND 1+ year(s) experience in security analysis, security research, cyber security, security engineering, software engineering, or relevant area
• OR equivalent experience
• 5+ years experience applying security or control frameworks, such as NIST CSF, NIST SP 800-53, or ISO/IEC 27001
• 5+ years experience in technical risk management, information security, audit, or compliance

Desirable

• As part of GRC’s Entity Risk function, you will join the Technical Risk team and partner with engineering, security, and product subject-matter experts and leaders across GitHub to conduct capability risk assessments, develop and quantify risk scenarios, and deliver meaningful risk reporting that helps leaders make risk-informed decisions
• Central to the team's culture is that of inclusion, transparency, and teamwork - we lift each other up to be successful! This is an excellent opportunity for an independent contributor to have a hand in elevating risk management and security as business and sales enabler as well as integrate a deeper understanding of risk management into the product and business space
• Lead security capability risk assessments for assigned areas, including scoping against NIST CSF subcategories, coordinating schedules and stakeholder interviews, completing maturity scoring, and publishing assessment reports
• Analyze data from multiple sources to identify, analyze, and prioritize technical risks, develop and quantify FAIR-style cyber risk scenarios, evaluate capabilities against established frameworks, and assess potential impacts to GitHub – our products, services, customers, and business objectives
• Partner with engineering, security, and product subject-matter experts and leaders to validate findings, identify risk patterns, and translate technical insights and stakeholder feedback into practical risk recommendations
• Develop and manage risk treatment plans, drive adoption of appropriate mitigations and remediation, monitor treatment progress, and escalate unresolved or emerging risks
• Maintain the risk register and supporting records in GitHub’s GRC system of record, track mitigation progress, and provide clear, recurring risk updates to technical and non-technical leaders