Manage submissions through the vulnerability lifecycle, including researcher questions, internal escalation, remediation tracking, retesting, and closure. Strong technical documentation skills, including the ability to clearly communicate reproduction steps, impact, and remediation guidance.
Numbers & Facts
Location
GA
Description
Our client, a Commercial Banking company, is looking for a Cyber Security Analyst - Vulnerability / Bug Bounty for their Remote location.
Responsibilities:
Review and triage incoming bug bounty submissions for validity, severity, impact, and duplication.
Reproduce reported vulnerabilities and document clear technical evidence and reproduction steps.
Work with application/product teams to validate findings and support remediation.
Evaluate vulnerability severity using CVSS, exploitability, business impact, and environmental context.
Manage submissions through the vulnerability lifecycle, including researcher questions, internal escalation, remediation tracking, retesting, and closure.
Identify recurring vulnerability patterns and opportunities to improve detection or preventative controls.
Assist with bug bounty scope reviews, asset onboarding, exclusions, and program documentation.
Support reporting and metrics around submission volume, severity, remediation status, and vulnerability trends.
Partner with security engineering teams to translate researcher techniques and findings into actionable security improvements.
Requirements:
Hands-on experience validating and reproducing web application, API, and/or cloud security vulnerabilities.
Strong understanding of common vulnerability classes including OWASP Top 10 and authorization/access-control issues.
Practical experience with HTTP, REST APIs, authentication/authorization mechanisms, and web application architecture.
Experience using security testing tools such as Burp Suite, browser developer tools, API clients, and scripting tools.
Ability to independently analyze vulnerability reports and distinguish valid security issues from duplicates, informational findings, or non-security behavior.
Strong technical documentation skills, including the ability to clearly communicate reproduction steps, impact, and remediation guidance.
Experience working with engineering/application teams through vulnerability remediation and retesting.
Ability to manage multiple vulnerability investigations simultaneously with limited supervision."
Direct experience with HackerOne or another vulnerability disclosure/bug bounty platform.
Previous participation as a bug bounty researcher or vulnerability researcher.
Experience testing APIs, mobile applications, authentication systems, or complex authorization models.
Experience with cloud security, particularly AWS or Azure.
Familiarity with source-code review and secure coding practices.
Experience developing scripts or tooling in Python, PowerShell, JavaScript, or similar languages to assist vulnerability validation.
Familiarity with attack-surface management, asset discovery, threat hunting, or security detection engineering.
Security certifications such as OSCP, OSWE, BSCP, GWAPT, GPEN, or comparable hands-on experience."