Bug Bounty Triage Analyst

Rootedsec; Northern (KY); Hybrid; USD 105,000 - 135,000; Full time

Job summary

SentinelOne is seeking a Remote Bug Bounty Triage Analyst in the United States to assess vulnerability reports, reproduce issues, and assign severities for engineering action. You will be the main liaison to researchers, explaining duplicates, scope, or non-vulnerabilities.

The role requires strong web security fundamentals, quick, fair severity judgement, and clear, precise writing. CVSS fluency is a plus for this position.

Qualifications

• Strong web security fundamentals.
• Fast, fair judgement on severity.
• Writes well enough to defuse an argument.
• CVSS fluency is a nice-to-have.

Responsibilities

• Reproduce reports and settle severity with evidence.
• Rewrite findings so an engineer can act without asking questions.
• Keep researchers informed, including when the answer is no.

Skills

Web security fundamentals

Severity assessment

Technical writing

Communication

Job description

# Bug Bounty Triage AnalystRemote, United States· REMOTEHacker+ signal## SentinelOneAssess incoming vulnerability reports, confirm them and prepare them for the engineering team.Type: FULLTIMERange: USD 105.000 – 135.000 per yearMode: REMOTEMinimum rank: Hacker## About the roleYou handle the queue of reports submitted by external security researchers. For each one you attempt to reproduce the issue, assign a severity based on the demonstrated impact, and rewrite it so that an engineer can act on it without further questions. You are also the point of contact for the researcher, which includes explaining clearly when a report is a duplicate, out of scope, or not a vulnerability.### What you will do* Reproduce reports and settle severity with evidence* Rewrite findings so an engineer can act without asking questions* Keep researchers informed, including when the answer is no### What they ask for* Strong web security fundamentals* Fast, fair judgement on severity* Writes well enough to defuse an argument### Nice to have* Bug bounty experience from the researcher side* CVSS fluency