Help the refugees

If you move around the world by choice, consider helping those forced from their homes by conflict. Donate to the UN Refugee Agency today.


Senior Software Engineer: CodeQL Security Analysis

Visit website

Please read the following job description thoroughly to ensure you are the right fit for this role before applying.
GitHub is the home for software development, where developers collaborate to build some of the world’s most important software. The security of that software is a collective problem, a responsibility that involves producers and consumers of code, open source maintainers, security researchers, and security teams. At GitHub, we want to give the community the tools it needs to secure the software we all depend on.

CodeQL is one such tool. With a suite of analyses developed in the open, CodeQL is a leading security analysis tool, and we make it available for free to any open-source project. Hundreds of CVEs have been found (by us at GitHub and others) and thousands of vulnerabilities fixed, and this is just the beginning.

Join the CodeQL team to help us bring the CodeQL technology to yet more of the world’s software. Improve our analysis precision and framework models to find real-world vulnerabilities, and engage with open-source maintainers and security researchers to make CodeQL the best it can be. Show our customers what a world-class security analysis solution can do. Make a difference to the security of the world’s open-source software.


  • Help us redefine what’s possible through static analysis and variant analysis . as part of a team of code analysis and programming language experts
  • Use CodeQL, our revolutionary declarative logic programming language, to create maintainable, robust, and low-noise automated analyses that help millions of developers write more secure code
  • Engage with open-source maintainers and security researchers to create and deploy cutting-edge security analyses
  • Model the security characteristics of widely used libraries and frameworks
  • Find and report real vulnerabilities in open source code
  • Apply our analyses at scale to tune and improve them; address false positive/false negative reports; make them scale to the largest code bases in the world while keeping turnaround time minimal; review open-source contributions; test and share analysis implementations across programming languages

Minimum qualifications

  • A good understanding and significant professional experience of security principles, mitigations, and common vulnerable patterns
  • Good knowledge of one or more popular programming languages: C/C++, C#, Go, Java, JavaScript/TypeScript, Kotlin, Python, Ruby, Swift

We expect applicants to have at least one of the following, but do not expect familiarity with all areas.

  • A strong interest in security research, evidenced by participation in bug bounty programs or credited CVEs
  • A passion for open-source, with a track record of maintainership or contribution, or two years’ experience of software development in the context of a large code base
  • Successful advocacy for or use of static analysis tools, fuzzers, profilers, or dynamic analysis tools
  • Experience in mentoring others, especially to teach complex technical ideas or processes
  • Strong written and verbal communication skills, ideally illustrated by technical blog articles or presentations
  • Experience with the performance characteristics of querying relational databases. We work as a distributed group within a distributed company. The majority of our team members live in Europe and across the US and Canada, and while we do have some offices, all our meetings are location-agnostic and happen online. We operate with a high degree of autonomy and trust, and we have a significant level of influence on the product and technical direction of CodeQL, as well as the broader code intelligence products at GitHub. We value learning, introspection and reflection, and we’re always looking for ways to improve as a team and as individuals, so candor and a culture that values safety to speak up are highly important to us

GitHub is the developer company. We make it easier for developers to be developers: to work together, to solve challenging problems, and to create the world’s most important technologies. We foster a collaborative community that can come together—as individuals and in teams—to create the future of software and make a difference in the world.

Leadership Principles

Customer Obsessed – Trust by Default – Ship to Learn – Own the Outcome – Growth Mindset – Global Product, Global Team – Anything is Possible – Practice Kindness

Why You Should Join

At GitHub, we constantly strive to create an environment that allows our employees (Hubbers) to do the best work of their lives. We’ve designed one of the coolest workspaces in San Francisco (HQ), where many Hubbers work, snack, and create daily. The rest of our Hubbers work remotely around the globe. Check out an updated list of where we can hire here:

We are also committed to keeping Hubbers healthy, motivated, focused and creative. We’ve designed our top-notch benefits program with these goals in mind. In a nutshell, we’ve built a place where we truly love working, we think you will too.

GitHub is made up of people from a wide variety of backgrounds and lifestyles. We embrace diversity and invite applications from people of all walks of life. We don’t discriminate against employees or applicants based on gender identity or expression, sexual orientation, race, religion, age, national origin, citizenship, disability, pregnancy status, veteran status, or any other differences. Also, if you have a disability, please let us know if there’s any way we can make the interview process better for you; we’re happy to accommodate!

Please note that benefits vary by country. If you have any questions, please don’t hesitate to ask your Talent Partner.

Apply now