Cyber Security Analyst

Mindlance; Atlanta (GA); On-site; USD 90,000 - 150,000; Full time

Job summary

Mindlance seeks a Security Analyst in Atlanta to review and triage bug bounty submissions, reproduce vulnerabilities, and collaborate with engineering teams to validate findings and remediation.

The role emphasizes applying CVSS, understanding OWASP Top 10, documenting steps, and supporting reporting on vulnerability trends. Ideal candidates have hands-on testing experience and strong technical writing skills, with the ability to manage multiple investigations with limited supervision.

Qualifications

• Validate and reproduce web app, API, and cloud security vulnerabilities.
• Understand OWASP Top 10 and authorization/access-control issues.
• Work with API/authentication mechanisms and web app architecture.
• Use Burp Suite, browser tools, API clients, and scripting tools.
• Analyze vulnerability reports and distinguish valid issues from duplicates.
• Document reproduction steps, impact, and remediation guidance.
• Coordinate with engineering teams for remediation and retesting.
• Manage multiple investigations with limited supervision.

Responsibilities

• Review and triage incoming bug bounty submissions for validity, severity, impact, and duplication.
• Reproduce reported vulnerabilities and document clear technical evidence and reproduction steps.
• Work with application/product teams to validate findings and support remediation.
• Evaluate vulnerability severity using CVSS, exploitability, business impact, and environmental context.
• Manage submissions through the vulnerability lifecycle, including researcher questions, internal escalation, remediation tracking, retesting, and closure.
• Identify recurring vulnerability patterns and opportunities to improve detection or preventative controls.
• Assist with bug bounty scope reviews, asset onboarding, exclusions, and program documentation.
• Support reporting and metrics around submission volume, severity, remediation status, and vulnerability trends.
• Partner with security engineering teams to translate researcher techniques and findings into actionable security improvements.

Skills

Bug bounty triage

Vulnerability validation

OWASP Top 10

Web/API security concepts

Documentation and reporting

Cross-team collaboration

Multitask management

Education

Bachelor’s degree preferred

Tools

Burp Suite

Browser developer tools

API clients

Scripting basics (Python/PowerShell/JS)

Job description

Description

Business Initiative/Purpose: (Goal, Business Impact, Accomplishments from the work)

• Supplement remediation of Bug Bounty findings.

Bachelor Degree: (Required, Preferred or Not Required)

• Preferred.

Role Responsibilities: (what they will be doing)

• Review and triage incoming bug bounty submissions for validity, severity, impact, and duplication.
• Reproduce reported vulnerabilities and document clear technical evidence and reproduction steps.
• Work with application/product teams to validate findings and support remediation.
• Evaluate vulnerability severity using CVSS, exploitability, business impact, and environmental context.
• Manage submissions through the vulnerability lifecycle, including researcher questions, internal escalation, remediation tracking, retesting, and closure.
• Identify recurring vulnerability patterns and opportunities to improve detection or preventative controls.
• Assist with bug bounty scope reviews, asset onboarding, exclusions, and program documentation.
• Support reporting and metrics around submission volume, severity, remediation status, and vulnerability trends.
• Partner with security engineering teams to translate researcher techniques and findings into actionable security improvements.

Must Have Skills/Prior Experiences: (Vendor should not submit any candidate that does not have these skills/prior experience.)

• Hands-on experience validating and reproducing web application, API, and/or cloud security vulnerabilities.
• Strong understanding of common vulnerability classes including OWASP Top 10 and authorization/access-control issues.
• Practical experience with HTTP, REST APIs, authentication/authorization mechanisms, and web application architecture.
• Experience using security testing tools such as Burp Suite, browser developer tools, API clients, and scripting tools.
• Ability to independently analyze vulnerability reports and distinguish valid security issues from duplicates, informational findings, or non-security behavior.
• Strong technical documentation skills, including the ability to clearly communicate reproduction steps, impact, and remediation guidance.
• Experience working with engineering/application teams through vulnerability remediation and retesting.
• Ability to manage multiple vulnerability investigations simultaneously with limited supervision.

Plus/Nice to Have Skills/Prior Experiences:(Hiring Manager DOES NOT require these skills/ prior experience. However candidates with any of these will be looked at first.)

• Direct experience with HackerOne or another vulnerability disclosure/bug bounty platform.
• Previous participation as a bug bounty researcher or vulnerability researcher.
• Experience with cloud security, particularly AWS or Azure.
• Experience testing APIs, mobile applications, authentication systems, or complex authorization models.
• Familiarity with source-code review and secure coding practices.
• Experience developing scripts or tooling in Python, PowerShell, JavaScript, or similar languages to assist vulnerability validation.
• Familiarity with attack-surface management, asset discovery, threat hunting, or security detection engineering.
• Security certifications such as OSCP, OSWE, BSCP, GWAPT, GPEN, or comparable hands-on experience.

EEO:
“Mindlance is an Equal Opportunity Employer and does not discriminate in employment on the basis of – Minority/Gender/Disability/Religion/LGBTQI/Age/Veterans.”