Onsite AppSec Program Manager — Bug Bounty & Automation

Cybersecurity Jobs; San Francisco (CA); On-site; USD 166,000 - 177,000; Full time

Job summary

JSM Consulting India is hiring an Application Security Program Manager for an onsite contract in San Francisco, CA. This role owns the day-to-day vulnerability remediation program, starting with HackerOne bug bounty findings and application, API, and GraphQL authorization issues.

The contractor will coordinate the end-to-end remediation lifecycle across internal teams and external vendors, covering validation, tracking, routing, remediation accountability, and program closure.

Qualifications

• 5+ years experience in Software Engineering or Application Security.
• Strong knowledge of REST APIs, GraphQL, Authentication & Authorization, OAuth, JWT, OWASP Top 10, and API Security Top 10.
• Experience reproducing security findings using Postman and security tooling.
• Experience with Jira and ServiceNow for tracking work.
• GenAI automation experience is a plus.

Responsibilities

• Own day-to-day management of the HackerOne program, including vulnerability intake, triage, validation, routing, tracking, and closure.
• Coordinate weekly operating reviews with HackerOne and internal stakeholders.
• Track remediation commitments and drive accountability across teams.
• Manage disclosure and communication processes.
• Reproduce and validate reported vulnerabilities.
• Assess exploitability and business impact for findings.
• Apply expertise across web applications, REST APIs, GraphQL, authentication, and authorization issues.
• Use Postman, browser tooling, and security testing tools to validate findings.
• Support vulnerability prioritization based on customer and business risk.
• Coordinate remediation efforts across multiple engineering organizations.
• Work with engineering managers, technical leads, and product owners.
• Identify service ownership and route findings appropriately.
• Maintain tracking in Jira and ServiceNow.
• Escalate critical and overdue items.
• Produce executive-level reporting and dashboards.
• Track backlog trends, SLA compliance, remediation progress, and risk reduction.
• Present status updates to cybersecurity and engineering leadership.
• Leverage GenAI and workflow automation to improve vulnerability triage, remediation tracking, reporting, service ownership identification, and repetitive program-management activities.

Skills

REST APIs

GraphQL

Authentication

Authorization

OAuth

JWT

OWASP Top 10

API Security Top 10

Postman

Jira

ServiceNow

Stakeholder mgmt

Bug bounty

AppSec

Penetration testing

Full-stack dev

Burp Suite

GenAI automation

HackerOne

Tools

HackerOne

Job description

JSM Consulting India is hiring an Application Security Program Manager for an onsite contract in San Francisco, CA. This role owns the day-to-day vulnerability remediation program, starting with HackerOne bug bounty findings and application, API, and GraphQL authorization issues.

The contractor will coordinate the end-to-end remediation lifecycle across internal teams and external vendors, covering validation, tracking, routing, remediation accountability, and program closure.