# Senior Security Engineer, Bug Bounty

**Company:** [Mozilla](https://hotfix.jobs/companies/mozilla)
**Location:** Remote
**Role:** Security Engineering
**Salary:** $116k – $183k/yr
**Experience:** 3+ years
**Skills:** bug bounty, hackerone, bugzilla, AWS, GCP, Azure, heroku, JavaScript, Python, Go, Rust, Cloud Security, Vulnerability Management, Incident Response
**Posted:** 2026-07-20

> Own and scale Mozilla's web bug bounty program. Triage and validate reports from HackerOne/Bugzilla, drive vulnerability remediation with engineering teams, perform code reviews, and collaborate with SIRT on incidents. Requires 3+ years security engineering experience and bug bounty or bug hunting background.

## Job Description

## What you’ll do

- Own and scale Mozilla’s web bug bounty program, including strategy, prioritization, KPIs, and continuous improvement
- Act as the primary interface with external researchers and platforms (e.g., HackerOne), fostering a high-quality and trusted research community
- Lead triage and technical validation of incoming reports across multiple intake channels (HackerOne, Bugzilla, email)
- Drive end-to-end vulnerability remediation, partnering with engineering teams to ensure timely, effective fixes
- Identify root causes and systemic issues, and influence long-term improvements in secure development practices
- Collaborate with the Security Incident Response Team (SIRT) on active incidents and post-incident reviews
- Perform targeted code reviews (primarily JavaScript and Python) during investigations and high-risk changes
- Develop or leverage tooling to improve triage efficiency, signal quality, and program insights

## What you’ll bring

- 3+ years of demonstrated ability in a security engineering role
- Experience operating bug bounty programs, including enhancements, automation and scaling, and/or bug hunting
- Practical experience working with modern cloud technologies (eg. Amazon Web Services, Google Cloud Platform, Heroku, Microsoft Azure, etc.)
- Experience analyzing code and systems to move from vulnerability → root cause → prevention
- Real-world experience in software development and/or engineering operations
- Ability to develop your own tools as needed in a variety of programming languages (eg. Python, Go, Rust, Javascript, etc.) is a plus, but not required
- Strong communication, collaboration, and problem-solving skills, with the ability to influence and guide cross-functional teams

## What you’ll get

- Generous performance-based bonus plans to all eligible employees
- Rich medical, dental, and vision coverage
- Generous retirement contributions with 100% immediate vesting
- Quarterly all-company wellness days
- Country specific holidays plus a day off for your birthday
- One-time home office stipend
- Annual professional development budget
- Quarterly well-being stipend
- Considerable paid parental leave
- Employee referral bonus program
- Other benefits (life/AD&D, disability, EAP, etc. - varies by country)

## Similar roles

- [Sr. Security Engineer, Incident Response](https://hotfix.jobs/jobs/54c33dfc-1c96-47fb-896d-8a83b303c45e) - Navan - New York, NY - $113k – $252k/yr
- [Sr. Security Software Engineer, Corporate Security](https://hotfix.jobs/jobs/70d73ad2-d2ed-4b0c-b7bd-11ae186e7186) - Pinterest - Remote - $124k – $255k/yr
- [Corporate Security Lead](https://hotfix.jobs/jobs/2a1defd4-9d21-4eb0-906b-0feb7fd4acc1) - Northwood Space - Los Angeles, CA - $125k – $206k/yr
- [Senior Security Automation Engineer](https://hotfix.jobs/jobs/2e4e1230-924e-4c2c-8df4-cdee5ef22cdb) - Clickhouse - Remote - $125k – $205k/yr
- [Senior vCISO / GRC Consulting Manager](https://hotfix.jobs/jobs/1eb33f19-585a-4597-9abd-d0a9ddce8874) - Agency - Richmond, VA - $125k – $125k/yr

**Apply:** https://hotfix.jobs/jobs/5532c56d-7528-4966-9a33-ffec20c4a012
**Canonical:** https://hotfix.jobs/jobs/5532c56d-7528-4966-9a33-ffec20c4a012