1 day ago
Remote, MexicoMid Level
Responsibilities
- Partner with engineering to refine architecture, validate features, and prioritize security investments.
- Build secure defaults, libraries, and paved roads that eliminate classes of vulnerabilities.
- Tune SAST, DAST, SCA, and secret-scanning tools to reduce noise and improve security feedback.
- Help operate and improve Bugcrowd’s bug bounty program and provide feedback on platform features.
- Lead cross-functional product security projects from scoping through delivery and influence product and engineering roadmaps.
- Use code and automation to expand security coverage and eliminate repetitive work.
Requirements
- Have 3+ years of experience in product security, application security, or secure software development.
- Be able to review code, automate tasks, and build security tooling in at least one modern programming language such as Python, Go, Ruby, or Java.
- Have hands-on experience with threat modeling, secure code review, SAST, DAST, SCA, and common vulnerability classes including the OWASP Top 10.
- Demonstrate the ability to manage projects and influence partners across engineering, DevOps, and product.
- Hold a bachelor’s degree in engineering, computer science, or a relevant field, or have equivalent practical experience.
- Preferred qualifications include bug bounty or vulnerability disclosure experience, secure-by-default library development, cloud-native and Infrastructure as Code security experience, and experience in a high-growth security or SaaS company.
Benefits
- Fully remote, work-from-home 100% of the time.
- Reasonable accommodations are available for qualified individuals with disabilities.
- Employment is subject to applicable background checks.
Categories
About Bugcrowd
Bugcrowd builds a crowdsourced security platform used by security teams to run bug bounty, vulnerability disclosure, and penetration testing programs. The service combines SaaS workflow and triage with access to a vetted hacker community, paying researchers per validated finding while customers subscribe to managed programs. Founded in 2012 and headquartered in San Francisco, the privately held company emphasizes AI-driven matching and signal processing to prioritize actionable vulnerabilities.