Staff Security Engineer - Application/Product Security

📋 Description

• Own incoming bug bounty reports end-to-end: intake, reproduction, severity scoring, root cause
• Reproduce and validate reported vulnerabilities, building out incomplete proof-of-concept code
• Serve as the technical escalation point for the most complex and highest-severity reports
• Perform code review and root cause analysis to identify the underlying defect rather than the
• Propose remediations, or design them with engineering, and verify the fix resolves the issue.
• Assign and defend severity ratings using the program's severity framework.

🎯 Requirements

• 8+ years of hands-on experience in product security, application security, penetration testing, or
• Expertise in common web and application vulnerability classes and exploitation techniques.
• Expertise in vulnerability reproduction, severity assessment, and defensible risk scoring under
• Expertise in coordinated vulnerability disclosure.
• Strong code comprehension in Java, JavaScript, and Python, with the ability to trace root cause in
• Ability to write code and propose concrete fixes. This is not an application-building role, but you

🎁 Benefits

• Work personas (flexible, remote, or required in office) assigned based on role
• Flexible work environment with trust-based distributed work model
• Equal opportunity employer
• Reasonable accommodations for disabilities
• Export control compliance considerations as required