Software Engineer II, CodeQL and Code Review Agents

• Denmark
• Engineering
• Experienced Professional
• Individual Contributor
• Yes
• 4619
• Full Time

About GitHub

As the global home for all developers, GitHub is the complete AI-powered developer platform to build, scale, and deliver secure software. Over 150+ million developers, including more than 90% of the Fortune 100 companies, use GitHub to collaborate and experiment across 420+ million repositories. With all the collaborative features of GitHub, it has never been easier for individuals and teams to write faster, better code.

Locations

In this role you can work from Remote, Denmark

Overview

GitHub is the home for software development, where we collaborate to build the world's leading AI-powered developer platform.

In the GitHub code scanning team, we are passionate about ensuring the security and quality of the world's software - from open source to the enterprise. We believe that the best way to secure and improve the quality of software is to detect actionable issues early in the development process, and actively facilitate their remediation as part of the developer workflow.

Our team develops CodeQL and Copilot Autofix, detection and remediation capabilities that power the GitHub code scanning product, used by hundreds of thousands of developers and projects every day as part of GitHub's Advanced Security and Code Security offerings.

CodeQL is GitHub's own semantic code analysis engine that uses world-class static analysis research and technology to deeply analyze code, enabling the early detection of security vulnerabilities and correctness errors in software. CodeQL supports a wide range of programming languages, including C/C++, C#, Go, Java, JavaScript/TypeScript, Kotlin, Python, Ruby, and Swift.

Copilot Autofix is our LLM-powered remediation system that produces high-quality fix suggestions for code scanning alerts, empowering developers to fix alerts as soon as they are found or that already exist in their codebase.

Responsibilities

In this role, you will join one of the distributed engineering teams responsible for building and expanding the core capabilities of code scanning with CodeQL and Copilot Autofix, in one of the following tracks:

• Code analysis: Maintaining support for multiple programming languages, including:
• building source code extractors that translate code written in each language into data that CodeQL can understand, keeping up with the latest version of each supported language
• writing and maintaining queries in the CodeQL query language that accurately detect security vulnerabilities and undesirable coding patterns
• ensuring the quality of LLM-powered Copilot Autofix suggestions for fixing the alerts found
• building analysis libraries in the CodeQL query language that reason precisely about the semantics of programming languages, supporting the development of queries across all languages
• experimenting with and robustly evaluating LLM-powered detection engines and integration between LLMs and traditional static analysis.
• AI engines: Building, expanding, and robustly evaluating LLM-based engines for remediation and detection. These power Copilot code review, which produces comment suggestions for quality issues in a codebase, and Copilot Autofix, which produces fix suggestions for code scanning alerts and Copilot code review findings.
• Engine quality: Developing and integrating CodeQL as a code scanning tool running in production in GitHub Actions, third-party CI systems, the command line, and the IDE; and building systems that evaluate the quality of CodeQL and LLM-based engines at large scale over thousands of codebases.

In any of the above tracks, you will work closely with various engineering teams, product managers, designers, and technical writers that build different aspects of the code scanning product, to influence product direction and deliver features to users, with clear focus on quality, reliability, and user experience. You will engage with internal users and external users (both from enterprise customers and the open-source community) to help them succeed with the product. You'll influence and provide feedback on the organizational culture and processes, always looking for opportunities to improve in a continuous pursuit of excellence.

Qualifications

Required Qualifications:

For this role, we're looking for a software engineer with:

• 2+ years experience in Software Engineering, Computer Science, or related technical discipline with proven experience maintaining production software coding in languages including, but not limited to, C, C++, C#, Java, JavaScript, Go, Ruby, Rust, or Python
• OR Associate's Degree in Computer Science, Electrical Engineering, Electronics Engineering, Math, Physics, Computer Engineering, Computer Science, or related field AND 1+ year(s) experience
• OR Bachelor's Degree in Computer Science or related field
• OR equivalent experience.
• 1+ years of experience with one or more of the following areas:
• Software security, including static analysis, dynamic analysis, software supply chain security, and best practices in creating high-quality, secure code
• Experience building developer tools that operate on source code, such as compilers, parsers, linters, static analyzers, debuggers, CLI tools, or IDE extensions
• Machine learning applied to understanding source code, specifically using prompt engineering with large language models (LLMs) and systematic data collection and result evaluation

Preferred Qualifications:

Additionally, we would highly encourage applying if you have one or more of the following skills:

• The interest and ability to learn additional programming languages as required
• Ability to work with multiple stakeholders and teams across engineering, product, and design
• Excellent verbal and written communication skills
• Experience working in a distributed team, operating effectively across multiple time zones (our teams span a wide time zone range from Pacific time to Central European time)
• Passion for fostering good engineering practices, tools, and processes
• Knowledge of compilers, program analysis, programming language design and implementation
• Knowledge of logic programming or database query languages (e.g. SQL, Prolog, Datalog, Kusto Query Language)
• Building integrations with CI/CD systems, such as GitHub Actions or Jenkins

GitHub values

• Customer-obsessed
• Ship to learn
• Growth mindset
• Own the outcome
• Better together
• Diverse and inclusive

Manager fundamentals

• Model
• Coach
• Care

Leadership principles

• Create clarity
• Generate energy
• Deliver success

Who We Are

GitHub is the world's leading AI-powered developer platform with 150 million developers and counting. We're also home to the biggest open-source community on earth (and 99% of the world's software has open-source code in its DNA). Many of the apps and programs you use every day are built on GitHub.

Our teams are dreamers, doers, and pioneers, leading the way in AI, driving humanitarian efforts around the globe, and even sending open source to Mars (and beyond). At GitHub, our goal is to create the space you need to do your best work. We're remote-first and offer competitive pay, generous learning and growth opportunities, and excellent benefits to support you, wherever you are—because we know that people flourish when they can work on their own terms.

Join us, and let's change the world, together.

Equal Employment Opportunity

GitHub is made up of people from a wide variety of backgrounds and lifestyles. We embrace diversity and invite applications from people of all walks of life. We don't discriminate against employees or applicants based on gender identity or expression, sexual orientation, race, religion, age, national origin, citizenship, disability, pregnancy status, veteran status, or any other differences. Also, if you have a disability, please let us know if there's any way we can make the interview process better for you; we're happy to accommodate