Lead Bug Bounty & Web Security Engineer

Mozilla; Greater London; On-site; GBP 75,000 - 110,000; Full time

Benefits offered by this job

Health, dental & vision benefits

Quarterly wellbeing stipend

Paid parental leave

Annual professional development budget

Life/AD&D and disability insurance

Internet reimbursement for remote work

Job summary

Mozilla is seeking a Security Engineer to own and manage the Web Bug Bounty program, collaborating with product and SIRT teams to mitigate security incidents. You will lead triage, validation, and remediation across multiple intake channels and drive long-term improvements in secure development practices.

You’ll work with external researchers via HackerOne and Mozilla engineering teams to ensure timely, effective fixes and meaningful program insights.

Qualifications

• Experience owning or managing a web bug bounty program.
• Ability to triage and validate vulnerability reports across multiple channels.
• Experience partners with engineering teams to drive remediation.
• Strong understanding of secure development practices.

Responsibilities

• Own and scale Mozilla’s web bug bounty program, including strategy, prioritization, KPIs, and continuous improvement.
• Act as the primary interface with external researchers and platforms (e.g., HackerOne).
• Lead triage and technical validation of incoming reports across HackerOne, Bugzilla, and email.
• Drive end-to-end vulnerability remediation with engineering teams.
• Identify root causes and systemic issues to improve secure development practices.
• Collaborate with SIRT on active incidents and post-incident reviews.
• Perform targeted code reviews in JavaScript and Python during investigations and high-risk changes.
• Develop or leverage tooling to improve triage efficiency and program insights.

Skills

Bug bounty program management

External researcher liaison

Triage & validation

JavaScript code review

Python code review

Vulnerability remediation

Security incident response

Tools

HackerOne

Bugzilla

Job description

Mozilla is seeking a Security Engineer to own and manage the Web Bug Bounty program, collaborating with product and SIRT teams to mitigate security incidents. You will lead triage, validation, and remediation across multiple intake channels and drive long-term improvements in secure development practices.

You’ll work with external researchers via HackerOne and Mozilla engineering teams to ensure timely, effective fixes and meaningful program insights.