Senior Security Engineer, Bug Bounty

This is a fully remote position, open to applicants in Germany.

📋 Description

• Take ownership and expand Mozilla's web bug bounty program, encompassing strategy, prioritization, KPIs, and ongoing enhancements.

• Serve as the main point of contact with external researchers and platforms (e.g., HackerOne), nurturing a high-quality and trustworthy research community.

• Oversee the triage and technical validation of incoming reports from various channels (HackerOne, Bugzilla, email).

• Facilitate comprehensive vulnerability remediation by collaborating with engineering teams to ensure prompt and effective solutions.

• Identify the root causes and systemic issues, influencing long-term enhancements in secure development practices.

• Work closely with the Security Incident Response Team (SIRT) on active incidents and conduct post-incident reviews.

• Execute targeted code reviews (mainly in JavaScript and Python) during investigations and high-risk modifications.

• Create or utilize tools to enhance triage efficiency, signal quality, and program insights.

⛳️ Requirements

• A minimum of 3 years of proven experience in a security engineering role.

• Experience managing bug bounty programs, including improvements, automation, scaling, and/or bug hunting.

• Hands-on experience with modern cloud technologies (e.g., Amazon Web Services, Google Cloud Platform, Heroku, Microsoft Azure, etc.).

• Proficient in analyzing code and systems to transition from vulnerability to root cause to prevention.

• Real-world experience in software development and/or engineering operations.

• Ability to develop tools as required in various programming languages (e.g., Python, Go, Rust, JavaScript, etc.) is advantageous but not mandatory.

• Excellent communication, collaboration, and problem-solving abilities, with a capacity to influence and guide cross-functional teams.

• Formal qualifications are valuable, but practical experience, curiosity, passion, and a growth mindset are more important.

🏝️ Benefits

• Generous performance-based bonus plans for all eligible employees - we succeed together as one team.

• Comprehensive medical, dental, and vision coverage.

• Significant retirement contributions with 100% immediate vesting (regardless of your contributions).

• Quarterly all-company wellness days where everyone takes a collective pause.

• Country-specific holidays plus an additional day off for your birthday.

• One-time stipend for home office setup.

• Annual budget for professional development.

• Quarterly stipend for well-being initiatives.

• Generous paid parental leave.

• Employee referral bonus program.

• Additional benefits (life/AD&D, disability, EAP, etc. - varies by country).