← All roles

Senior Risk Analyst

GitHub· Security
Apply on company site
Hybrid (Remote, United States)$124k - $329.2kFull-timePosted 4d ago

About the role

GitHub is seeking a detail-oriented individual contributor with a technical bent and experience in technical risk management to join the Technical Risk team within GRC’s Entity Risk function. The role focuses on conducting capability risk assessments, developing and quantifying risk scenarios, and delivering risk reporting to inform risk-informed decisions, partnering with engineering, security, and product stakeholders.

Responsibilities

  • Lead security capability risk assessments for assigned areas, including scoping against NIST CSF subcategories, coordinating schedules and stakeholder interviews, completing maturity scoring, and publishing assessment reports.
  • Analyze data from multiple sources to identify, analyze, and prioritize technical risks, develop and quantify FAIR-style cyber risk scenarios, evaluate capabilities against established frameworks, and assess potential impacts to GitHub – our products, services, customers, and business objectives.
  • Partner with engineering, security, and product subject-matter experts and leaders to validate findings, identify risk patterns, and translate technical insights and stakeholder feedback into practical risk recommendations.
  • Develop and manage risk treatment plans, drive adoption of appropriate mitigations and remediation, monitor treatment progress, and escalate unresolved or emerging risks.
  • Maintain the risk register and supporting records in GitHub’s GRC system of record, track mitigation progress, and provide clear, recurring risk updates to technical and non-technical leaders.

Qualifications

  • 7+ years experience in security analysis, security research, cyber security, security engineering, software engineering, or relevant area (with alternative education paths as specified).
  • 5+ years experience applying security or control frameworks, such as NIST CSF, NIST SP 800-53, or ISO/IEC 27001.
  • 5+ years experience in technical risk management, information security, audit, or compliance.

Skills

Required:Security risk assessment
Nice to have:Risk quantification (CRQ / FAIR)GRC and risk registers

Benefits

  • The base salary range for this job is USD $124,000.00 - USD $329,200.00 /Yr.
Last updated Oct 22, 2026. Interested? Apply on the company site.

About GitHub

Change is constant. GitHub keeps you ahead.

Join the world's most widely adopted, AI-powered developer platform where millions of developers, businesses, and the largest open source community build software that advances humanity.

developer platformAI-poweredsoftware developmentopen source
Company profileWebsite

More open roles at GitHub