Lead Web Bug Bounty Security Engineer

Mozilla; United States; On-site; USD 126,000 - 183,000; Full time

Benefits offered by this job

Bonus plans

Medical/dental/vision coverage

Retirement contributions

Wellness days

Birthday day off

Home office stipend

PD budget

Well-being stipend

Parental leave

Referral bonus

Job summary

Mozilla is seeking a Security Engineer to own and scale the Web Bug Bounty program, collaborating with product and SIRT teams to mitigate security incidents and events.

You will perform triage of reports, validate findings, and drive remediation with engineering teams while developing tools to improve triage efficiency. Strong coding skills and experience with bug bounty platforms are required.

Qualifications

• 3+ years in a security engineering role.
• Experience operating bug bounty programs with automation and scaling.
• Practical experience with cloud technologies (AWS, GCP, Azure, etc.).
• Experience analyzing code and systems to move from vulnerability to root cause to prevention.
• Real-world software development/ops experience.
• Ability to develop tools in Python, Go, Rust, or JavaScript is a plus.

Responsibilities

• Own and scale Mozilla’s web bug bounty program, including strategy and KPIs.
• Serve as primary interface with external researchers and platforms like HackerOne.
• Lead triage and validation of reports across multiple channels (HackerOne, Bugzilla, email).
• Drive end-to-end vulnerability remediation with engineering teams.
• Identify root causes and influence long-term secure development improvements.
• Collaborate with SIRT on incidents and post-incident reviews.
• Perform targeted code reviews (JavaScript, Python) during investigations.
• Develop or leverage tooling to improve triage efficiency and program insights.

Skills

Security engineering

Bug bounty programs

Cloud platforms

Code analysis

Software development

Programming languages

Communication

Tools

HackerOne

Bugzilla

AWS

GCP

Azure

Job description

Mozilla is seeking a Security Engineer to own and scale the Web Bug Bounty program, collaborating with product and SIRT teams to mitigate security incidents and events.

You will perform triage of reports, validate findings, and drive remediation with engineering teams while developing tools to improve triage efficiency. Strong coding skills and experience with bug bounty platforms are required.