Address
Form of work
SalaryLocations: In this role you can work from Remote, United Kingdom
Overview:
GitHub is the home for software development, where we collaborate to build the world's leading developer platform.
In the GitHub code scanning team, we are passionate about securing the world’s software - from open source to the enterprise. We believe that the best way to secure software is to detect security issues early in the development process, and deliver a great user experience that engages, supports, and motivates developers to fix security vulnerabilities in a way that integrates naturally in their workflows.
Our team develops and operates the code scanning product that’s part of GitHub’s Advanced Security offering. A central part of code scanning is CodeQL, GitHub's own semantic code analysis engine that uses world-class static analysis research and technology to deeply analyze code, enabling the early detection of security vulnerabilities and correctness errors in software. CodeQL currently supports a wide range of programming languages, including C/C++, C#, Go, Java, JavaScript/TypeScript, Kotlin, Python, Ruby, and Swift.
Come join one of the distributed engineering teams responsible for building and expanding the code analysis capabilities of CodeQL, used by hundreds of thousands of developers and projects every day. In this role, you will continuously innovate to expand the core capabilities of CodeQL in one of the following tracks:
Security research
- In this track, you will work primarily on the CodeQL default queries and analysis libraries, as part of a CodeQL language analysis team.
- You will write queries in the CodeQL query language to detect new security vulnerabilities with high precision, reduce the false negative rate of the existing analysis by building models of widely-used libraries and frameworks, and contribute your expert security knowledge to refine the LLM-powered autofix capabilities included in GitHub code scanning for alerts produced by CodeQL.
Program analysis
- In this track, you will work primarily on the CodeQL default queries, analysis libraries, and CodeQL extractors that process source code, as part of a CodeQL language analysis team.
- You will ensure CodeQL works well across a wide variety of programming language versions, operating systems, build systems, and customer environments. You will build and maintain analysis libraries in the CodeQL query language that reason precisely about the semantics of programs in multiple supported languages.
CodeQL foundations
- In this track, you will be part of the CodeQL Foundations team, and work primarily on QL, the query language powering CodeQL analysis, and its underlying query compiler and evaluator within the CodeQL CLI.
- You will expand the expressive power of the CodeQL query language and speed up the performance of the underlying query engine, empowering the other CodeQL teams to write high-quality analysis that scales to the largest codebases in the world.
CodeQL experiences
- In this track, you will be part of the CodeQL Experiences team, and work primarily on the CodeQL CLI, the CodeQL Action, the CodeQL extension for Visual Studio Code, GitHub backend services and APIs, and AI-powered autofix and threat modeling capabilities.
- You will work on integrating CodeQL as a code scanning tool into GitHub Actions, third-party CI systems, the command line, and the IDE. You will be responsible for shipping and monitoring CodeQL in production, and making its analysis even more powerful through AI-powered autofix suggestions and elegant mechanisms for customization and threat modeling.
In any of the above tracks, you will work closely with various engineering teams, product managers, designers, and technical writers that build different aspects of the code scanning product, to influence product direction and deliver features to users, with clear focus on quality, reliability, and user experience. You will engage with internal users and external users (both from enterprise customers and the open-source community) to help them succeed with the product. You will grow and scale the product, working as part of our Security Products group towards our mission of securing the world’s software. You’ll influence and provide feedback on the organizational culture and processes, always looking for opportunities to improve in a continuous pursuit of excellence.
Your application will be considered for each of the tracks above, based on your own experience and the availability of roles on our teams.
Minimum Qualifications:
For this role, we’re looking for an experienced Software Engineer with:
- A few years of experience in Software Engineering or security research, with a high level of familiarity with Java, JavaScript/TypeScript, C++, C#, Rust, or a comparable programming language, and the interest and ability to learn additional languages as required
and a high level of familiarity with one or more of the following areas:
- Software security, including static analysis, dynamic analysis, software supply chain security, or best practices in application security
- Experience building developer tools that operate on source code, such as compilers, parsers, static analyzers, debuggers, CLI tools, or IDE extensions
- Knowledge of compilers, program analysis, programming language design and implementation
advanced knowledge of logic programming or database query languages (e.g. SQL, Prolog, Datalog, Kusto Query Language) - Building integrations with CI/CD systems, such as GitHub Actions or Jenkins
- Machine learning applied to understanding source code, specifically using prompt engineering with large language models (LLMs) and systematic data collection and result evaluation
- Experience with the C++, Python, Go, Ruby, or Swift programming languages
Preferred Qualifications:
Strong applicants will also have:
- The ability to work with multiple stakeholders and teams across engineering, product, and design
- Experience operating user-facing software at scale, including availability and observability
- Experience working in a distributed team, operating effectively across multiple time zones (our teams span a wide time zone range from Pacific time to Central European time)
- A passion for fostering good engineering practices, tools, and processes
GitHub values
- Customer-obsessed
- Ship to learn
- Growth mindset
- Own the outcome
- Better together
- Diverse and inclusive
Manager fundamentals
- Model
- Coach
- Care
Leadership principles
- Create clarity
- Generate energy
- Deliver success
Our teams are dreamers, doers, and pioneers, leading the way in AI, driving humanitarian efforts around the globe, and even sending open source to Mars (and beyond!). At GitHub, our goal is to create the space you need to do your best work. We’re remote-first and offer competitive pay, generous learning and growth opportunities, and excellent benefits to support you, wherever you are—because we know that people flourish when they can work on their own terms.
Join us, and let’s change the world, together.
EEO Statement: GitHub is made up of people from a wide variety of backgrounds and lifestyles. We embrace diversity and invite applications from people of all walks of life. We don't discriminate against employees or applicants based on gender identity or expression, sexual orientation, race, religion, age, national origin, citizenship, disability, pregnancy status, veteran status, or any other differences. Also, if you have a disability, please let us know if there's any way we can make the interview process better for you; we're happy to accommodate!
