Senior Software Engineer, Vulnerability Management
Company: GitHub
Location: Remote (Remote)
Salary: $124,000 - $329,200 a year
Type: Full-time
Remote: Yes
Posted: 2026-10-16
About this role
About GitHub: GitHub is the world’s leading platform for agentic software development — powered by Copilot to build, scale, and deliver secure software. Over 180 million developers, including more than 90% of the Fortune 100 companies, use GitHub to collaborate, and more than 77,000 organisations have adopted GitHub Copilot.
Locations: In this role you can work from Remote, United States
Overview:
Securing the home for all developers starts with securing GitHub itself. As a Senior Software Engineer on the Vulnerability Management Engineering team, you’ll build and run the systems that find vulnerabilities across GitHub’s services and infrastructure, get each one to the team that owns it, and control how our code, packages, and container images are sourced and built. It’s backend and distributed systems work where the users are other engineers, and you’ll build deep expertise in vulnerability management and software supply chain security along the way.
We are looking for creative problem solvers and diverse thinkers, people who care about culture as well as customers and features. We believe that how we do things is as important as what we do. Big vision, a common purpose, passion for quality, curiosity, dedication, and investment in fun and collaboration are what lead to great results. Great products reflect the teams that build them.
Responsibilities:
- Design, develop, test and ship high-quality technical solutions that scale across multiple GitHub services.
- Build the platform that collects security findings from container image, cloud, host, and code scanning, matches each finding to the team that owns it, and tracks remediation through risk scoring, SLAs, and exceptions.
- Design and roll out software supply chain controls, such as authenticated package and container proxies that enforce policy, across GitHub Actions, Docker builds, and Dependabot, in a way teams can adopt without slowing down.
- Build systems that meet compliance requirements such ...