Cyber security analyst – vulnerability / bug bounty

Our client, a Commercial Banking company, is looking for a Cyber Security Analyst – Vulnerability / Bug Bounty for their Remote location.

Responsibilities:

• Review and triage incoming bug bounty submissions for validity, severity, impact, and duplication.
• Reproduce reported vulnerabilities and document clear technical evidence and reproduction steps.
• Work with application/product teams to validate findings and support remediation.
• Evaluate vulnerability severity using CVSS, exploitability, business impact, and environmental context.
• Manage submissions through the vulnerability lifecycle, including researcher questions, internal escalation, remediation tracking, retesting, and closure.
• Identify recurring vulnerability patterns and opportunities to improve detection or preventative controls.
• Assist with bug bounty scope reviews, asset onboarding, exclusions, and program documentation.
• Support reporting and metrics around submission volume, severity, remediation status, and vulnerability trends.
• Partner with security engineering teams to translate researcher techniques and findings into actionable security improvements.

Requirements:

• Hands-on experience validating and reproducing web application, API, and/or cloud security vulnerabilities.
• Strong understanding of common vulnerability classes including OWASP Top 10 and authorization/access-control issues.
• Practical experience with HTTP, REST APIs, authentication/authorization mechanisms, and web application architecture.
• Experience using security testing tools such as Burp Suite, browser developer tools, API clients, and scripting tools.
• Ability to independently analyze vulnerability reports and distinguish valid security issues from duplicates, informational findings, or non-security behavior.
• Strong technical documentation skills, including the ability to clearly communicate reproduction steps, impact, and remediation guidance.
• Experience working with engineering/application teams through vulnerability remediation and retesting.
• Ability to manage multiple vulnerability investigations simultaneously with limited supervision.
• Direct experience with HackerOne or another vulnerability disclosure/bug bounty platform.
• Previous participation as a bug bounty researcher or vulnerability researcher.
• Experience testing APIs, mobile applications, authentication systems, or complex authorization models.
• Experience with cloud security, particularly AWS or Azure.
• Familiarity with source-code review and secure coding practices.
• Experience developing scripts or tooling in Python, PowerShell, JavaScript, or similar languages to assist vulnerability validation.
• Familiarity with attack-surface management, asset discovery, threat hunting, or security detection engineering.
• Security certifications such as OSCP, OSWE, BSCP, GWAPT, GPEN, or comparable hands-on experience.

Why Should You Apply?

• Health Benefits
• Referral Program
• Excellent growth and advancement opportunities