Application Security Engineer - Bugcrowd

About Bugcrowd

Founded in 2012, Bugcrowd is the preemptive security platform that unifies exposure discovery and assessment, offensive testing, and intelligence shaped by AI and human insight to help organizations avoid, discover, and validate real-world risk. Bugcrowd helps security teams move faster by identifying the exposures that matter most so they can act first and stay ahead of attackers. Based in San Francisco and New Hampshire, Bugcrowd is supported by General Catalyst, Rally Ventures, Costanoa Ventures, and others.

Job Summary

At Bugcrowd, we handle application security assessment at an epic scale. As an Application Security Engineer (ASE) you will curate and manage the incoming security vulnerability submissions to some of the world’s biggest companies’ bug bounty programs.

• Work on security programs across hundreds of diverse organizations
• Collaborate with top security researchers and gain exposure to advanced vulnerability types including XSS, SQLi, XXE, IDOR, SSTI, SSRF, and more
• Engage with unique programs including IoT, embedded systems, automotive security, and mobile applications

Essential Duties & Responsibilities

• Manage ongoing triage and validation services for Bugcrowd managed programs under the direction of the Director of Technical Operations
• Curate incoming vulnerability submission data for validity, accuracy, and severity
• Communicate directly with clients and security researchers when additional information is required
• Handle incident response by escalating and communicating high-severity vulnerabilities to clients
• Apply strong knowledge of OWASP Top Ten vulnerabilities to daily assessments
• Utilize scripting and development skills to design and build tooling to streamline the triage and validation process

Education, Experience, Skills & Abilities

• Bachelor’s degree or equivalent security consulting experience
• Published and demonstrated passion for security assessment research
• High proficiency with Burp Suite (or other interception proxies) and working experience with industry standard tools (Nmap, SQLmap, Kali Linux suite)
• Ability to write code or scripts in at least one language for tooling and automation
• Strong knowledge of OWASP Top Ten vulnerabilities
• Proven ability to execute individual projects while contributing effectively to a team
• Excellent organization, influencing, and communication skills

Working Conditions

• 100% remote, work-from-home position