Bug Bounty Triage Analyst

Rootedsec; Singapore; Sur place; SGD 70 000 - 100 000; Plein temps

Résumé du poste

Shopee in Singapore is seeking a Bug Bounty Triage Analyst onsite to manage incoming reports from external security researchers. You reproduce issues, assign severity with evidence, and rewrite findings so engineers can act without further questions.

You are the primary liaison, explaining duplicates, out-of-scope items, and non-vulnerabilities, while keeping researchers informed and engaged. Applicants should have solid web security basics, fast, fair judgment on severity, and clear written

Qualifications

• Strong web security fundamentals.
• Ability to assess severity quickly with evidence.
• Excellent written communication to de-escalate disputes.

Responsabilités

• Reproduce reports and settle severity with evidence.
• Rewrite findings so engineers can act without questions.
• Keep researchers informed, including handling duplicates and non-vulnerabilities.

Connaissances

Web security

Severity assessment

Researcher comms

Description du poste

Open roleShopee# Bug Bounty Triage AnalystSingapore· ONSITE## About the roleYou handle the queue of reports submitted by external security researchers. For each one you attempt to reproduce the issue, assign a severity based on the demonstrated impact, and rewrite it so that an engineer can act on it without further questions. You are also the point of contact for the researcher, which includes explaining clearly when a report is a duplicate, out of scope, or not a vulnerability.### What you will do* Reproduce reports and settle severity with evidence* Rewrite findings so an engineer can act without asking questions* Keep researchers informed, including when the answer is no### What they ask for* Strong web security fundamentals* Fast, fair judgement on severity* Writes well enough to defuse an argument### Nice to have* Bug bounty experience from the researcher side* CVSS fluency## What applying with Rooted meansThis role accepts applications with Rooted context. Instead of sending only a resume, you can attach a verifiable credential with your proofs, rank, and technical evidence.Your application includes your Rooted credential: rank, verified proofs, and supporting evidence.You can read this role without an account. To apply you need a Rooted credential.This role is curated by Rooted. Rooted is not the hiring company unless explicitly stated. The hiring company is Shopee. Confirm the final details with the original source or during the application process.Posted 2026-08-13