Product Security Engineer III

Role Description

GitHub is transforming how the world builds secure software, and we are looking for a Product Security Engineer III to join our Product Security Engineering team. This is a hands-on engineering role focused on building internal security platforms, tooling, and automation that protect GitHub's products at scale.

• Design, build, and maintain security tooling and automation, including static analysis pipelines, secret scanning workflows, and dependency analysis systems.
• Contribute to scalable solutions that reduce recurring vulnerability patterns, focusing on preventing classes of vulnerabilities rather than addressing individual instances.
• Build and improve agentic security tooling for automated triage, assessment, and remediation of security findings.
• Develop security libraries, CI/CD integrations, and developer-facing tools that make the secure path the default path for engineering teams.
• Contribute to supply chain security defenses, building detection and prevention systems that protect GitHub's software supply chain.
• Collaborate with teams across the organization to address security risks and define new requirements and feature sets.
• Analyze key metrics and KPIs to identify trends in security issues, evaluate the effectiveness of security tooling and automation, and recommend improvements to address gaps in measurement.

Qualifications

• 5+ years experience in security analysis, security research, cyber security, security engineering, or relevant area OR Associate's Degree in a related field AND 4+ years experience in security analysis, security research, cyber security, security engineering, or relevant area OR Bachelor's Degree in a related field AND 3+ years experience in security analysis, security research, cyber security, security engineering, or relevant area OR Master's Degree in a related field AND 1+ year(s) experience in security analysis, security research, cyber security, security engineering, or relevant area OR equivalent experience.
• 1+ year(s) of experience in building security tooling and implementing solutions in complex environments.
• 3+ years experience programming in at least 2 of these 3 coding languages: Ruby, Go, Python.

Requirements

• Experience with static analysis tools (SAST/DAST), code scanning frameworks, or custom rule authoring.
• Experience building agentic or AI-driven security tooling (e.g., automated triage, classification, or remediation).
• Familiarity with software supply chain security concepts and tooling.
• Experience working in large-scale monolith or distributed service codebases.
• Familiarity with GitHub's products, platform, and developer ecosystem.
• Strong expertise in security principles, including the Security Development Lifecycle (SDL), and experience in vulnerability management.

Benefits

• The base salary range for this job is USD $107,700.00 - USD $285,900.00 /Yr.
• Eligible for benefits and additional rewards, including annual bonus and stock.
• Rewards are allocated based on individual impact in role.
• Opportunity to earn sales incentives based on revenue or utilization, depending on the terms of the plan and the employee's role.