GitHub is the home for software development, where we collaborate to build the world's leading AI-powered developer platform.

In the Copilot Agents organization at GitHub, we are passionate about ensuring the security and quality of the world’s software - from open source to the enterprise, written by humans and by AI tools. We believe that the best way to secure and improve the quality of software is to detect actionable issues early in the development process, and actively facilitate their remediation as part of the developer workflow.

Our team develops detection and remediation engines that power several GitHub products used by hundreds of thousands of developers and projects every day:

• CodeQL is GitHub's semantic code analysis engine that uses world-class static analysis research and technology to deeply analyze code, enabling the early detection of security vulnerabilities and correctness errors in software. CodeQL supports a wide range of programming languages, including C/C++, C#, Go, Java, JavaScript/TypeScript, Kotlin, Python, Ruby, and Swift. It is used as the primary detection engine within the GitHub Code Security and GitHub Advanced Security products.

• Copilot Autofix is GitHub's LLM-powered remediation engine that produces high-quality fix suggestions for security or quality findings, empowering developers to fix them as soon as they are found or burn down the debt already existing in their codebase. It is used as the remediation engine within the GitHub Code Security, GitHub Advanced Security, and Copilot code review products.

• An LLM-based detection agent currently used as the primary detection engine within the Copilot code review product.

We work as a distributed group within a distributed company. The majority of our team members live across Europe, the US, and Canada, and while we do have some offices, all our meetings are location-agnostic and happen online. We operate with a high degree of autonomy and trust, and we have a significant level of influence on the product and technical direction of security and code review products at GitHub. We value learning, introspection and reflection, and we’re always looking for ways to improve as a team and as individuals, so candor and a culture that values safety to speak up are highly important to us.

We are looking for a Senior Software Engineer to join one of the distributed software engineering teams responsible for building and expanding code analysis engines and agents at GitHub. In this role you will work in one of the following areas, selected based on your own experience and interests, and the needs of the organization at the time of hiring:

• Code analysis: Maintaining detection support for multiple programming languages, including:

  • building source code extractors that translate code written in each language into data that CodeQL can understand, keeping up with the latest version of each supported language

  • writing and maintaining queries in the CodeQL query language that accurately detect security vulnerabilities and undesirable coding patterns

  • ensuring the quality of LLM-powered Copilot Autofix suggestions for fixing the alerts found

  • building analysis libraries in the CodeQL query language that reason precisely about the semantics of programming languages, supporting the development of queries across all languages

  • experimenting with and robustly evaluating LLM-powered detection engines and integration between LLMs and traditional static analysis.

• Foundations: Developing QL, the query language powering CodeQL analysis, and its underlying query compiler and evaluator within the CodeQL CLI. Expanding the expressive power of the CodeQL query language and speeding up the performance of the underlying query engine, empowering other teams to write high-quality analysis, and ensuring that CodeQL scales to the largest codebases in the world.

• AI agents:

  • LLM-based code review: Building, improving, and evaluating the detection agent for Copilot code review, using LLMs and contextual information from a codebase to produce AI-powered review comments on pull requests.

  • LLM-based fix generation: Building, improving, and evaluating the Copilot Autofix agent, using LLMs and contextual information to produce actionable AI-powered fix suggestions for code security and quality findings.

  • Improving the security and quality of code produced by Copilot coding agent, using the above engines and other security products at GitHub.

In any of the above tracks, you will work closely with various engineering teams, product managers, designers, and technical writers that build different aspects of the code scanning product, to influence product direction and deliver features to users, with clear focus on quality, reliability, and user experience. You will engage with internal users and external users (both from enterprise customers and the open-source community) to help them succeed with the product. You’ll influence and provide feedback on the organizational culture and processes, always looking for opportunities to improve in a continuous pursuit of excellence.

Required Qualifications

• 6+ years experience in Software Engineering, Computer Science, or related technical discipline with proven experience maintaining and delivering production software coding in languages including, but not limited to, C, C++, C#, Java, JavaScript/TypeScript, Go, Ruby, Rust, or Python.

  • • OR Associate’s Degree in Computer Science, Electrical Engineering, Electronics Engineering, Math, Physics, Computer Engineering, or related field AND 5+ years experience in Software Engineering, Computer Science, or related technical discipline with proven experience maintaining and delivering production software coding in languages including, but not limited to, C, C++, C#, Java, JavaScript/TypeScript, Go, Ruby, Rust, or Python.

    • OR Bachelor's Degree in Computer Science, Electrical Engineering, Electronics Engineering, Math, Physics, Computer Engineering, or related field AND 4+ years experience in Software Engineering, Computer Science, or related technical discipline with proven experience maintaining and delivering production software coding in languages including, but not limited to, C, C++, C#, Java, JavaScript/TypeScript, Go, Ruby, Rust, or Python

    • OR Master's Degree in Computer Science, Electrical Engineering, Electronics Engineering, Math, Physics, Computer Engineering, or related field AND 2+ years experience in Software Engineering, Computer Science, or related technical discipline with proven experience maintaining and delivering production software coding in languages including, but not limited to, C, C++, C#, Java, JavaScript/TypeScript, Go, Ruby, Rust, or Python.

    • OR Doctorate in Computer Science, Electrical Engineering, Electronics Engineering, Math, Physics, Computer Engineering, or related field.

    • OR equivalent experience.

• 3+ years of experience with one or more of the following areas:

  • • Software security, including static analysis, dynamic analysis, software supply chain security, and best practices in creating high-quality, secure code.

    • OR Experience building developer tools that operate on source code, such as compilers, parsers, linters, static analyzers, debuggers, CLI tools, or IDE extensions.

    • OR Machine learning and AI applied to understanding source code, specifically building systems that use large language models (LLMs) to generate or reason about code, and systematic benchmarking and evaluation of those systems.

Preferred Qualifications

• Experience with two or more of the areas listed above
• Experience designing and running statistically-sound experiments to measure performance and quality, evaluating results to minimize bias and noise.
• Industry or research knowledge of compilers, program analysis, programming language design and implementation.
  • OR Knowledge of logic programming or database query languages (e.g. SQL, Prolog, Datalog, Kusto Query Language).
• Experience in security research, demonstrated by a history of identifying, analyzing, and disclosing vulnerabilities in open-source projects. Comprehensive understanding of security best practices, attack vectors, and the vulnerability management lifecycle from discovery to remediation and disclosure.

GitHub values

• Customer-obsessed
• Ship to learn
• Growth mindset
• Own the outcome
• Better together
• Diverse and inclusive

Manager fundamentals

• Model
• Coach
• Care

Leadership principles

• Create clarity
• Generate energy
• Deliver success