23 hours ago
Remote, BrazilMid Level
Responsibilities
- Triage and validate incoming security vulnerability submissions for validity, accuracy, and severity.
- Curate submission data for Bugcrowd-managed programs serving large enterprise clients.
- Communicate with clients and security researchers when additional information is needed.
- Handle incident response by escalating and communicating high-severity vulnerabilities to clients.
- Apply knowledge of OWASP Top Ten vulnerabilities and related application security issues.
- Assist with designing or developing tooling to improve the triage and validation process.
- Execute individual projects while contributing to the broader team and completing tasks on time.
Requirements
- Bachelor’s degree or previous security consulting experience.
- Published and demonstrated passion for security assessment research.
- High proficiency with Burp Suite or another interception proxy.
- Working-level experience with industry-standard security tools such as nmap, sqlmap, and tools included in Kali Linux.
- Strong knowledge of application vulnerabilities including XSS, SQLi, XXE, IDOR, SSTI, and SSRF.
- Strong skill set in at least one scripting or development language.
- Strong organization, influencing, communication, and teamwork skills.
Benefits
- Five-month contract position.
- Fully remote, work-from-home 100% of the time.
- Exposure to security programs across applications, mobile applications, cars, IoT devices, and embedded systems.
- Opportunity to work with security researchers and cutting-edge security testing methodologies.
Categories
About Bugcrowd
Bugcrowd builds a crowdsourced security platform used by security teams to run bug bounty, vulnerability disclosure, and penetration testing programs. The service combines SaaS workflow and triage with access to a vetted hacker community, paying researchers per validated finding while customers subscribe to managed programs. Founded in 2012 and headquartered in San Francisco, the privately held company emphasizes AI-driven matching and signal processing to prioritize actionable vulnerabilities.