4 months ago
Base Salary
$180k - $325k/yr
Responsibilities
- Manage vulnerability intake from bug bounty platforms, customer reports, automated scanners, pentest reports, and coordinated disclosure channels.
- Validate, reproduce, severity-score, document, and deduplicate vulnerability findings.
- Assess exploitability and relevance using OWASP, cloud misconfiguration patterns, and identity, authentication, and authorization risks.
- Coordinate with Engineering, SecOps, IT, SRE, and Cloud Security to confirm impact and drive remediation.
- Provide reproduction steps, proof-of-concepts, technical analyses, SLA tracking, regression testing, and systemic improvements.
- Support SOC 2, ISO 27001, and pentest evidence requirements within the vulnerability lifecycle.
- Design and evolve the bug bounty program, including scope, rules, rewards, platform selection, launches, and community engagement.
- Communicate with security researchers, handle clarifications and disputes, and determine rewards, bonuses, and recognition.
- Lead coordinated vulnerability disclosure, negotiate timelines, coordinate CVE assignments and publications, and prepare customer and public advisories.
Requirements
- Experience running or triaging bug bounty programs, ideally using HackerOne.
- Ability to independently triage, validate, and reproduce vulnerabilities.
- Deep understanding of web, application, and cloud vulnerability classes, OWASP Top 10, cloud misconfigurations, and authentication and authorization issues.
- Familiarity with cloud platforms, preferably GCP, and SaaS architectures.
- Strong understanding of software engineering fundamentals, code structure, and CI/CD workflows.
- Scripting or automation experience with Python, Go, or Bash is preferred.
- Pentesting or offensive security experience is preferred.
- Familiarity with SOC 2 and ISO 27001 is preferred.
- Experience authoring public advisories or CVE writeups is preferred.
- Hands-on experience with SIEM, Cloud Logging, and investigative tooling is preferred.
Benefits
- Full-time employee role based in the Foster City, California office with in-office work required Monday, Wednesday, and Friday.
- 401(k) program with a 4% match.
- Health, dental, vision, and life insurance.
- Short-term and long-term disability coverage.
- Paid parental, medical, and caregiver leave.
- Commuter benefits.
- Monthly wellness stipend.
- Autonomous work environment.
- In-office setup reimbursement.
- Flexible time off and holidays.
- Quarterly team gatherings and in-office amenities.
Tech Stack
Categories
About Replit
Replit is the agentic software creation platform that enables anyone to build applications using natural language. With millions of users worldwide and over 500,000 business users, Replit is democratizing software development by removing traditional barriers to application creation.