Lead Web Bug Bounty & Security Engineer

Mozilla Corporation; United States; Remote; USD 120,000 - 180,000; Full time

Benefits offered by this job

Generous bonus plans

Medical, dental, vision coverage

100% vesting retirement contributions

Home office stipend

Well-being stipend

Paid parental leave

Employee referral bonus

Job summary

Mozilla Corporation is seeking a security engineer to own and manage the Web Bug Bounty program and collaborate with product and SIRT teams to mitigate security incidents. You will scale the program, triage reports from HackerOne/Bugzilla, and drive remediation with engineering to improve secure development practices.

In this role, you’ll work across cloud platforms, engage with external researchers, and help shape the organization’s security posture while contributing to Mozilla’s mission of an

Qualifications

• 3+ years in a security engineering role.
• Experience operating bug bounty programs, including automation and scaling.
• Practical experience with modern cloud technologies (AWS, GCP, Heroku, Azure).
• Experience analyzing code and systems to move from vulnerability to root cause to prevention.
• Real-world experience in software development or engineering operations.

Responsibilities

• Own and scale Mozilla’s web bug bounty program, including strategy and KPIs.
• Interface with external researchers and platforms (e.g., HackerOne).
• Lead triage and validation of incoming reports across multiple channels.
• Drive end-to-end vulnerability remediation with engineering teams.
• Identify root causes and drive improvements in secure development practices.
• Collaborate with SIRT on active incidents and post-incident reviews.
• Develop tooling to improve triage efficiency and program insights.

Skills

Security engineering

Bug bounty programs

Cloud platforms

Code analysis

SDLC / DevOps

Cross-functional collaboration

Tools

AWS

GCP

Heroku

Azure

Job description

Mozilla Corporation is seeking a security engineer to own and manage the Web Bug Bounty program and collaborate with product and SIRT teams to mitigate security incidents. You will scale the program, triage reports from HackerOne/Bugzilla, and drive remediation with engineering to improve secure development practices.

In this role, you’ll work across cloud platforms, engage with external researchers, and help shape the organization’s security posture while contributing to Mozilla’s mission of an