Cyber Security Analyst

Manage submissions through the vulnerability lifecycle, including researcher questions, internal escalation, remediation tracking, retesting, and closure. Strong technical documentation skills, including the ability to clearly communicate reproduction steps, impact, and remediation guidance.

Description:
Business Initiative/Purpose: (Goal, Business Impact, Accomplishments from the work)

• Supplement remediation of Bug Bounty findings.

Bachelor Degree: (Required, Preferred or Not Required)

• Preferred.

Role Responsibilities: (what they will be doing)

• Review and triage incoming bug bounty submissions for validity, severity, impact, and duplication.
• Reproduce reported vulnerabilities and document clear technical evidence and reproduction steps.
• Work with application/product teams to validate findings and support remediation.
• Evaluate vulnerability severity using CVSS, exploitability, business impact, and environmental context.
• Manage submissions through the vulnerability lifecycle, including researcher questions, internal escalation, remediation tracking, retesting, and closure.
• Identify recurring vulnerability patterns and opportunities to improve detection or preventative controls.
• Assist with bug bounty scope reviews, asset onboarding, exclusions, and program documentation.
• Support reporting and metrics around submission volume, severity, remediation status, and vulnerability trends.
• Partner with security engineering teams to translate researcher techniques and findings into actionable security improvements.

Must Have Skills/Prior Experiences: (Vendor should not submit any candidate that does not have these skills/prior experience.)

• Hands-on experience validating and reproducing web application, API, and/or cloud security vulnerabilities.
• Strong understanding of common vulnerability classes including OWASP Top 10 and authorization/access-control issues.
• Practical experience with HTTP, REST APIs, authentication/authorization mechanisms, and web application architecture.
• Experience using security testing tools such as Burp Suite, browser developer tools, API clients, and scripting tools.
• Ability to independently analyze vulnerability reports and distinguish valid security issues from duplicates, informational findings, or non-security behavior.
• Strong technical documentation skills, including the ability to clearly communicate reproduction steps, impact, and remediation guidance.
• Experience working with engineering/application teams through vulnerability remediation and retesting.
• Ability to manage multiple vulnerability investigations simultaneously with limited supervision.

Plus/Nice to Have Skills/Prior Experiences:(Hiring Manager DOES NOT require these skills/ prior experience. However candidates with any of these will be looked at first.)

• Direct experience with HackerOne or another vulnerability disclosure/bug bounty platform.
• Previous participation as a bug bounty researcher or vulnerability researcher.
• Experience with cloud security, particularly AWS or Azure.
• Experience testing APIs, mobile applications, authentication systems, or complex authorization models.
• Familiarity with source-code review and secure coding practices.
• Experience developing scripts or tooling in Python, PowerShell, JavaScript, or similar languages to assist vulnerability validation.
• Familiarity with attack-surface management, asset discovery, threat hunting, or security detection engineering.
• Security certifications such as OSCP, OSWE, BSCP, GWAPT, GPEN, or comparable hands-on experience.

EEO:
Mindlance is an Equal Opportunity Employer and does not discriminate in employment on the basis of Minority/Gender/Disability/Religion/LGBTQI/Age/Veterans.