Senior Security Engineer, Bug Bounty

Remotedxb; Dubai; On-site; AED 250,000 - 420,000; Full time

Benefits offered by this job

Performance-based bonus

Medical, dental, and vision coverage

Retirement contributions with 100%vest

Quarterly wellness days

Holidays + birthday day off

Home office stipend

Professional development budget

Well-being stipend

Paid parental leave

Job summary

Mozilla Corporation is seeking a Security Engineer to own and scale the web bug bounty program. You will partner with researchers and platforms like HackerOne, lead triage and validation, and drive remediation with engineering teams.

Ideal candidates will have 3+ years in security engineering, hands-on bug bounty experience, and strong coding ability in JavaScript or Python, plus cloud infrastructure familiarity. This is a dynamic role focused on secure development and program optimization.

Qualifications

• 3+ years of experience in a security engineering role.
• Experience operating bug bounty programs or bug hunting.
• Practical experience with modern cloud technologies (AWS, GCP, Heroku, or Azure).
• Experience analyzing code and systems to move from vulnerability to root cause prevention.
• Real-world experience in software development or engineering operations.
• Strong communication, collaboration, and problem-solving skills.

Responsibilities

• Own and scale Mozilla’s web bug bounty program, including strategy, prioritization, KPIs, and continuous improvement.
• Act as the primary interface with external researchers and platforms like HackerOne.
• Lead triage and technical validation of incoming reports across multiple intake channels.
• Drive end-to-end vulnerability remediation by partnering with engineering teams.
• Identify root causes and systemic issues to influence secure development practices.
• Collaborate with the Security Incident Response Team (SIRT) on active incidents.
• Perform targeted code reviews in JavaScript and Python.
• Develop or leverage tooling to improve triage efficiency and program insights.

Skills

Security engineering

Bug bounty programs

Cloud platforms

Code analysis

Software development

Communication

Tooling in Python/Go/Rust/JavaScript

Job description

Responsibilities

• Own and scale Mozilla’s web bug bounty program, including strategy, prioritization, KPIs, and continuous improvement
• Act as the primary interface with external researchers and platforms like HackerOne
• Lead triage and technical validation of incoming reports across multiple intake channels
• Drive end-to-end vulnerability remediation by partnering with engineering teams
• Identify root causes and systemic issues to influence secure development practices
• Collaborate with the Security Incident Response Team (SIRT) on active incidents
• Perform targeted code reviews in JavaScript and Python
• Develop or leverage tooling to improve triage efficiency and program insights

Requirements

• 3+ years of experience in a security engineering role
• Experience operating bug bounty programs or bug hunting
• Practical experience with modern cloud technologies (AWS, GCP, Heroku, or Azure)
• Experience analyzing code and systems to move from vulnerability to root cause prevention
• Real-world experience in software development or engineering operations
• Strong communication, collaboration, and problem-solving skills

Preferred Qualifications

• Ability to develop tools in Python, Go, Rust, or JavaScript

Benefits

• Performance-based bonus plans
• Medical, dental, and vision coverage
• Retirement contributions with 100% immediate vesting
• Quarterly all-company wellness days
• Country specific holidays plus a day off for your birthday
• One-time home office stipend
• Annual professional development budget
• Quarterly well-being stipend
• Paid parental leave

About the Company

Mozilla Corporation is a non-profit-backed technology company dedicated to making the internet a global public resource that is open and accessible to all. We are the creators of Firefox and focus on privacy, security, and open-source software.