Security Analyst, Bug Bounty Remote - Americas

Shopify; Ontario; Remote; CAD 70,000 - 90,000; Full time

Job summary

Join a leading company as a Security Analyst in the Trust & Security Team, focusing on bug bounty programs. You'll assess and manage security vulnerabilities, communicate with hackers, and contribute to improving security processes. This role requires excellent communication skills and a foundational knowledge of cybersecurity.

Qualifications

• Understanding of common security issues like OWASP Top 10.
• Strong investigative, analytical, and decision-making skills.

Responsibilities

• Assess, validate, retest, and close bug bounty reports.
• Communicate with hackers and answer questions about their reports.
• Create and maintain documentation supporting the program.

Skills

Communication

Analytical

Investigative

Tools

Burp Suite

Job description

We're looking for two curious and detail-oriented individuals to join Shopify's Trust & Security Team as a Security Analyst for our bug bounty program.

As part of the Application Security team in Trust, you'll contribute to Shopify's mission of making commerce better and safer for everyone. The team focuses on discovering, fixing, and preventing security vulnerabilities across Shopify's code and ecosystem. Our bug bounty program enables us to collaborate with a global hacker community to identify security issues.

Role Responsibilities:

1. Assess, validate, retest, and close bug bounty reports.
2. Escalate complex reports to application security engineers.
3. Coordinate with internal teams to resolve bug bounty reports.
4. Communicate with hackers on the platform and answer questions about their reports.
5. Participate in security incident response activities related to bug bounty reports.
6. Create and maintain internal and external documentation supporting the program.
7. Contribute to process and program improvements.

Qualifications:

• Understanding of common security issues such as the OWASP Top 10.
• Experience with DAST tools like Burp Suite.
• Excellent communication skills—clear, concise, friendly, and firm.
• Ability to assess and escalate high vs. low risk issues effectively.
• Experience communicating with diverse audiences and de-escalating tense situations.
• Ability to maintain a consistent operational rhythm.
• Strong investigative, analytical, and decision-making skills.
• Basic understanding of how web requests and applications work.
• Foundational cybersecurity knowledge and awareness of common risks.
• A desire to build a career in cybersecurity.

Preferred but not required:

• Experience with Ruby development.
• Participation in bug bounty or previous bounty program experience.
• Experience working with system owners to remediate issues.
• Familiarity with frameworks such as CVSS.
• Passion for bug bounty programs and the hacker community.