Lead Product Security Engineer – Vulnerability Response

Replit; United States; On-site; USD 120,000 - 170,000; Full time

Benefits offered by this job

Remote‑First environment

Flexible work hours

Health, dental, vision, life insurance

Monthly stipend for expenses

Disability insurance

Home office stipend

Parental leave

Commuter benefits

401k program

Flexible PTO + holidays

Annual offsites

Job summary

Replit is seeking a highly skilled PSIRT Engineer to lead the vulnerability response program for its cloud-native AI platform. You will own the lifecycle of security vulnerabilities from intake to validation, remediation coordination, and public disclosure.

You will work with Engineering, Cloud Security, SecOps, SRE, and IT teams to ensure vulnerabilities are fixed quickly and communicated responsibly, while managing bug bounty intake and producing detailed analyses.

Qualifications

• Experience leading vulnerability response programs for SaaS/cloud platforms.
• Deep knowledge of web/app/cloud vulnerabilities and exploit classes.
• Experience with bug bounty coordination and responsible disclosure.

Responsibilities

• Lead the vulnerability response program for Replit’s cloud-native AI platform.
• Own vulnerability lifecycle from intake to remediation coordination and disclosure.
• Collaborate with Engineering, SecOps, SRE, and IT to fix and communicate fixes.
• Manage intake from bug bounty platforms, customer reports, scanners, pentest reports.
• Validate, reproduce, severity-score, and document findings.
• Maintain clean vulnerability records and remove duplicates.
• Assess exploitability using OWASP and cloud patterns.
• Coordinate remediation with cross-functional teams to confirm product impact.
• Provide reproduction steps and technical analyses; track SLAs and testing.
• Support SOC 2, ISO 27001 evidence and vulnerability lifecycle governance.
• Design and evolve bug bounty program scope, rules, and rewards.
• Coordinate CVE assignments, disclosures, and customer advisories.

Skills

Vulnerability research

Bug bounty programs

OWASP Top 10

Cloud platforms (GCP)

CI/CD

Scripting (Python/Go/Bash)

Coordinated disclosure

Public advisories

Investigative tooling

Tools

HackerOne

SIEM

Cloud Logging

Job description

Replit is seeking a highly skilled PSIRT Engineer to lead the vulnerability response program for its cloud-native AI platform. You will own the lifecycle of security vulnerabilities from intake to validation, remediation coordination, and public disclosure.

You will work with Engineering, Cloud Security, SecOps, SRE, and IT teams to ensure vulnerabilities are fixed quickly and communicated responsibly, while managing bug bounty intake and producing detailed analyses.