Bug Bounty Program Lead - Security Engineer

Doist; Germany (OH); Hybrid; USD 78,278 - 104,754; Full time

Benefits offered by this job

Generous bonus plans

Medical, dental, vision coverage

Retirement contributions with vesting

Home office stipend

Professional development budget

Well-being stipend

Parental leave

Job summary

Mozilla seeks a Security Engineer to own and manage the web bug bounty program, partnering with product and SIRT teams to ensure risk mitigation across incidents and events.

You will triage reports from HackerOne, Bugzilla, and email, lead remediation with engineering teams, and develop tools to improve triage quality and program insights. This is a remote Germany-based role with strong compensation and benefits.

Qualifications

• 3+ years in a security engineering role.
• Experience operating bug bounty programs and scaling efforts.
• Practical experience with modern cloud technologies (AWS, GCP, Heroku, Azure).
• Experience analyzing code and systems to move from vulnerability to root cause to prevention.
• Real-world software development/engineering operations experience.
• Ability to develop tools in Python, Go, Rust, JavaScript is a plus.
• Strong communication and cross-functional collaboration skills.

Responsibilities

• Own and scale Mozilla’s web bug bounty program, including strategy and KPIs.
• Interface with external researchers and platforms (e.g., HackerOne).
• Lead triage and validation of reports from multiple channels (HackerOne, Bugzilla, email).
• Drive end-to-end vulnerability remediation with engineering teams.
• Identify root causes and influence long-term secure development improvements.
• Collaborate with SIRT on active incidents and post-incident reviews.
• Perform targeted code reviews (JavaScript and Python) during investigations.
• Develop or leverage tooling to improve triage efficiency and program insights.

Skills

Security engineering

Bug bounty program management

Cloud technologies

Code analysis

Software development experience

Tool development

Communication & collaboration

Tools

AWS

Google Cloud Platform

Heroku

Microsoft Azure

Job description

Mozilla seeks a Security Engineer to own and manage the web bug bounty program, partnering with product and SIRT teams to ensure risk mitigation across incidents and events.

You will triage reports from HackerOne, Bugzilla, and email, lead remediation with engineering teams, and develop tools to improve triage quality and program insights. This is a remote Germany-based role with strong compensation and benefits.