Listing Description

GitHub is the home for software development, where developers collaborate to build some of the world's most important software. The security of that software is a collective problem, a responsibility that involves producers and consumers of code, open source maintainers, security researchers, and security teams. At GitHub, we want to give the community the tools it needs to secure the software we all depend on.

CodeQL is one such tool. With a suite of analyses developed in the open, CodeQL is a leading security analysis tool, and we make it available for free to any open-source project. Hundreds of CVEs have been found (by us at GitHub and others) and thousands of vulnerabilities fixed, and this is just the beginning.

Join the CodeQL team to help us bring the CodeQL technology to yet more of the world's software. Improve our analysis precision and framework models to find real-world vulnerabilities, and engage with open-source maintainers and security researchers to make CodeQL the best it can be. Show our customers what a world-class security analysis solution can do. Make a difference to the security of the world's open-source software.

Responsibilities:

• Help us redefine what’s possible through static analysis and variant analysis. as part of a team of code analysis and programming language experts.

• Use CodeQL, our revolutionary declarative logic programming language, to create maintainable, robust, and low-noise automated analyses that help millions of developers write more secure code.


• Engage with open-source maintainers and security researchers to create and deploy cutting-edge security analyses.


• Model the security characteristics of widely used libraries and frameworks.


• Find and report real vulnerabilities in open source code.


• Apply our analyses at scale to tune and improve them; address false positive/false negative reports; make them scale to the largest code bases in the world while keeping turnaround time minimal; review open-source contributions; test and share analysis implementations across programming languages.

Minimum qualifications

• A good understanding of security principles, mitigations, and common vulnerable patterns.


• Good knowledge of one or more popular programming languages: C/C++, C#, Go, Java, JavaScript/TypeScript, Kotlin, Python, Ruby, Swift.

Preferred Qualifications

We expect applicants to have at least one of the following, but do not expect familiarity with all areas.

• A strong interest in security research, evidenced by participation in bug bounty programs or credited CVEs.


• A passion for open-source, with a track record of maintainership or contribution, or two years' experience of software development in the context of a large code base.


• Successful advocacy for or use of static analysis tools, fuzzers, profilers, or dynamic analysis tools.


• Experience in mentoring others, especially to teach complex technical ideas or processes.


• Strong written and verbal communication skills, ideally illustrated by technical blog articles or presentations.


• Experience with the performance characteristics of querying relational databases.

We work as a distributed group within a distributed company. The majority of our team members live in Europe and across the US and Canada, and while we do have some offices, all our meetings are location-agnostic and happen online. We operate with a high degree of autonomy and trust, and we have a significant level of influence on the product and technical direction of CodeQL, as well as the broader code intelligence products at GitHub. We value learning, introspection and reflection, and we’re always looking for ways to improve as a team and as individuals, so candor and a culture that values safety to speak up are highly important to us.