Note: The job is a remote job and is open to candidates in USA. The hiring client is a confidential commercial banking company. The Cyber Security Analyst reviews and validates bug bounty submissions, coordinates vulnerability remediation and retesting, and helps improve security controls and reporting.
Responsibilities
- Review and triage incoming bug bounty submissions for validity, severity, impact, and duplication
- Reproduce reported vulnerabilities and document clear technical evidence and reproduction steps
- Work with application/product teams to validate findings and support remediation
- Evaluate vulnerability severity using CVSS, exploitability, business impact, and environmental context
- Manage submissions through the vulnerability lifecycle, including researcher questions, internal escalation, remediation tracking, retesting, and closure
- Identify recurring vulnerability patterns and opportunities to improve detection or preventative controls
- Assist with bug bounty scope reviews, asset onboarding, exclusions, and program documentation
- Support reporting and metrics around submission volume, severity, remediation status, and vulnerability trends
- Partner with security engineering teams to translate researcher techniques and findings into actionable security improvements
Skills
- Hands-on experience validating and reproducing web application, API, and/or cloud security vulnerabilities
- Strong understanding of common vulnerability classes including OWASP Top 10 and authorization/access-control issues
- Practical experience with HTTP, REST APIs, authentication/authorization mechanisms, and web application architecture
- Experience using security testing tools such as Burp Suite, browser developer tools, API clients, and scripting tools
- Ability to independently analyze vulnerability reports and distinguish valid security issues from duplicates, informational findings, or non-security behavior
- Strong technical documentation skills, including the ability to clearly communicate reproduction steps, impact, and remediation guidance
- Experience working with engineering/application teams through vulnerability remediation and retesting
- Ability to manage multiple vulnerability investigations simultaneously with limited supervision
- Direct experience with HackerOne or another vulnerability disclosure/bug bounty platform
- Previous participation as a bug bounty researcher or vulnerability researcher
- Experience testing APIs, mobile applications, authentication systems, or complex authorization models
- Experience with cloud security, particularly AWS or Azure
- Familiarity with source-code review and secure coding practices
- Experience developing scripts or tooling in Python, PowerShell, JavaScript, or similar languages to assist vulnerability validation
- Familiarity with attack-surface management, asset discovery, threat hunting, or security detection engineering
- Security certifications such as OSCP, OSWE, BSCP, GWAPT, GPEN, or comparable hands-on experience
Benefits
- Remote work arrangement
- Excellent growth and advancement opportunities
Company Overview
Company H1B Sponsorship