Senior Security Engineer, Bug Bounty
Own and scale Mozilla's web bug bounty program as the primary interface with external researchers. Lead triage, validation, remediation of reports, collaborate with SIRT on incidents, perform code reviews, and drive secure development improvements. Requires 3+ years security engineering experience and bug bounty or bug hunting background.
About the job
What you’ll do
- Own and scale Mozilla’s web bug bounty program, including strategy, prioritization, KPIs, and continuous improvement
- Act as the primary interface with external researchers and platforms (e.g., HackerOne), fostering a high-quality and trusted research community
- Lead triage and technical validation of incoming reports across multiple intake channels (HackerOne, Bugzilla, email)
- Drive end-to-end vulnerability remediation, partnering with engineering teams to ensure timely, effective fixes
- Identify root causes and systemic issues, and influence long-term improvements in secure development practices
- Collaborate with the Security Incident Response Team (SIRT) on active incidents and post-incident reviews
- Perform targeted code reviews (primarily JavaScript and Python) during investigations and high-risk changes
- Develop or leverage tooling to improve triage efficiency, signal quality, and program insights
What you’ll bring
- 3+ years of demonstrated ability in a security engineering role
- Experience operating bug bounty programs, including enhancements, automation and scaling, and/or bug hunting
- Practical experience working with modern cloud technologies (eg. Amazon Web Services, Google Cloud Platform, Heroku, Microsoft Azure, etc.)
- Experience analyzing code and systems to move from vulnerability → root cause → prevention
- Real-world experience in software development and/or engineering operations
- Ability to develop your own tools as needed in a variety of programming languages (eg. Python, Go, Rust, Javascript, etc.) is a plus, but not required
- Strong communication, collaboration, and problem-solving skills, with the ability to influence and guide cross-functional teams
What you’ll get
- Generous performance-based bonus plans to all eligible employees
- Rich medical, dental, and vision coverage
- Generous retirement contributions with 100% immediate vesting
- Quarterly all-company wellness days
- Country specific holidays plus a day off for your birthday
- One-time home office stipend
- Annual professional development budget
- Quarterly well-being stipend
- Considerable paid parental leave
- Employee referral bonus program
- Other benefits (life/AD&D, disability, EAP, etc. - varies by country)
Skills
Bug Bounty, Hackerone, Bugzilla, AWS, GCP, Azure, JavaScript, Python, Go, Rust, Cloud Security, Vulnerability Management, Incident Response, Code Review
Similar jobs
Security Engineering jobs
Docker
United KingdomSenior offensive security engineer responsible for penetration testing, adversary emulation, exploit development, threat modeling, and security automation across cloud, container, SaaS, and AI/ML systems. Requires at least 3 years of security engineering experience, strong development skills, and hands-on offensive security expertise.
Idme
McLean, VA
Leads cloud-native security operations, incident response, threat hunting, and forensic investigations while mentoring SOC analysts and improving detection processes. Requires 8+ years in information security, including hands-on cloud incident response and experience with Kubernetes, CI/CD, and advanced security tools.
ConductorOne
San Francisco, CASenior Security Engineer responsible for application, cloud, and platform security, with a focus on automating security workflows, threat modeling, secure development, and remediation. Requires hands-on SaaS security, cloud infrastructure, code review, and agent or automation experience.
Mercor
San Francisco, CA
Leads the company’s security GRC function, owning SOC 2, ISO 27001, enterprise audits, third-party risk, policy governance, and automated evidence workflows. Requires 7+ years of GRC or audit experience, end-to-end SOC 2 and ISO 27001 ownership, and strong security tooling expertise.
Anthropic
San Francisco, CALeads technical SOX controls assurance for financially significant systems, translating audit requirements into engineering acceptance criteria and continuous monitoring. Requires ITGC and SOX 404 expertise, strong engineering fluency, programming ability, and cross-functional collaboration with Finance, Engineering, and auditors.