Bug Bounty Security Engineer: Scale & Safeguard Web Apps

PVH (Tommy Hilfiger/Calvin Klein); United Kingdom; On-site; GBP 60,000 - 90,000; Full time

Benefits offered by this job

Generous bonus plans

Medical, dental, and vision coverage

Retirement contributions with vesting

Wellness days

Home office stipend

Professional development budget

Parental leave

Employee referral bonus

Job summary

Mozilla Corporation is seeking a Security Engineer to own and scale the Web Bug Bounty program, partnering with product and SIRT teams to mitigate security incidents and improve secure development practices.

You will triage reports via HackerOne, Bugzilla, and email, perform code reviews of JavaScript and Python, and develop tooling to enhance triage and insights. A strong background in bug bounty operations and cloud platforms is essential.

Qualifications

• 3+ years in a security engineering role.
• Experience operating bug bounty programs with automation and scaling.
• Experience with modern cloud technologies (AWS, GCP, Heroku, Azure).
• Ability to analyze code and systems to move from vulnerability to root cause to prevention.
• Real-world experience in software development or engineering operations.
• Ability to develop tools in languages such as Python, Go, Rust, or JavaScript.

Responsibilities

• Own and scale Mozilla's web bug bounty program including strategy and KPIs.
• Interface with external researchers and platforms (e.g., HackerOne).
• Lead triage and validation of reports across intake channels (HackerOne, Bugzilla, email).
• Drive end-to-end vulnerability remediation with engineering teams.
• Identify root causes and influence secure development improvements.
• Collaborate with SIRT on incidents and post-incident reviews.
• Perform targeted code reviews (JavaScript, Python) during investigations.
• Develop tools to improve triage efficiency and program insights.

Skills

Security engineering

Bug bounty program management

Cloud platforms

Code analysis

Multi-language programming

Tools

HackerOne

Bugzilla

AWS

GCP

Azure

Heroku

Job description

Mozilla Corporation is seeking a Security Engineer to own and scale the Web Bug Bounty program, partnering with product and SIRT teams to mitigate security incidents and improve secure development practices.

You will triage reports via HackerOne, Bugzilla, and email, perform code reviews of JavaScript and Python, and develop tooling to enhance triage and insights. A strong background in bug bounty operations and cloud platforms is essential.