Senior Security Engineer, Bug Bounty

Role Overview

As a Senior Security Engineer (Bug Bounty), you will own, manage, and administer Mozilla’s Web Bug Bounty program and collaborate with Mozilla product and SIRT (Security Incident Response Team) groups to mitigate security risks and improve outcomes.

Responsibilities

• Own and scale Mozilla’s web bug bounty program (strategy, prioritization, KPIs, and continuous improvement).
• Serve as the primary interface with external security researchers and bug bounty platforms (e.g., HackerOne).
• Triage and validate incoming vulnerability reports across intake channels (HackerOne, Bugzilla, email).
• Drive end-to-end vulnerability remediation by partnering with engineering teams for timely, effective fixes.
• Identify root causes and systemic issues, and influence long-term improvements in secure development practices.
• Collaborate with SIRT on active incidents and post-incident reviews.
• Perform targeted code reviews (primarily JavaScript and Python) for investigations and high-risk changes.
• Develop or leverage tooling to improve triage efficiency, signal quality, and program insights.

Requirements

• 3+ years of demonstrated experience in a security engineering role.
• Experience operating bug bounty programs (including enhancements, automation, and scaling) and/or bug hunting.
• Practical experience working with modern cloud technologies (e.g., AWS, GCP, Heroku, Azure).
• Ability to analyze code and systems to move from vulnerability → root cause → prevention.
• Real-world software development and/or engineering operations experience.
• Strong communication, collaboration, and problem-solving skills; ability to influence cross-functional teams.

Nice to Haves

• Experience building internal tools in languages such as Python, Go, Rust, JavaScript.
• Formal security credentials (preferred but not required).