Lead Bug Bounty & Security Program Engineer

Mozilla; Germany (OH); On-site; USD 77,660 - 103,928; Full time

Benefits offered by this job

Bonus plans based on performance

Medical, dental, and vision coverage

Retirement contributions with vesting

Home office stipend

Professional development budget

Parental leave

Job summary

Mozilla seeks a Security Engineer to own and scale the Web Bug Bounty program and work with product and SIRT teams to mitigate security incidents. You will perform triage, code reviews (JavaScript and Python), and develop tooling to improve triage efficiency.

Remote Germany‑based role with a mission to protect user privacy, contribute to secure development practices, and collaborate with cross‑functional teams across Mozilla's global product ecosystem.

Qualifications

• 3+ years in security engineering or equivalent
• Experience operating bug bounty programs, including enhancements and scaling
• Practical experience with modern cloud technologies (AWS, GCP, Azure, etc.)
• Experience analyzing code and systems to move from vulnerability to root cause and prevention
• Real-world software development or engineering operations experience
• Ability to develop tools in Python, Go, Rust, or JavaScript
• Strong communication and collaboration across teams
• Growth mindset and a proactive approach to security

Responsibilities

• Own and scale Mozilla's web bug bounty program across platforms
• Lead triage and validation of reports from HackerOne, Bugzilla, and email
• Drive end-to-end vulnerability remediation with engineering teams
• Identify root causes and influence secure development practices
• Collaborate with SIRT on incidents and post-incident reviews
• Perform targeted code reviews (JavaScript and Python) during investigations
• Develop tooling to improve triage efficiency and program insights

Skills

Security engineering

Bug bounty programs

Cloud platforms

Code analysis

Software development

Programming languages

Communication

Cross-functional collaboration

Tools

HackerOne

Bugzilla

AWS

GCP

Azure

Job description

Mozilla seeks a Security Engineer to own and scale the Web Bug Bounty program and work with product and SIRT teams to mitigate security incidents. You will perform triage, code reviews (JavaScript and Python), and develop tooling to improve triage efficiency.

Remote Germany‑based role with a mission to protect user privacy, contribute to secure development practices, and collaborate with cross‑functional teams across Mozilla's global product ecosystem.