PSIRT Engineer: Vulnerability Response & Bug Bounty Lead

Replit; Foster City (CA); On-site; USD 140,000 - 180,000; Full time

Benefits offered by this job

401(k) Match

Health, Dental, Vision, Life Insurance

Paid Leave

Flexible Time Off

Commuter Benefits

Wellness Stipend

In-Office Set-Up Reimbursement

Quarterly Team Gatherings

Autonomous Work Environment

In-Office Amenities

Job summary

Replit is seeking a PSIRT Engineer to own the vulnerability lifecycle for its cloud-native AI platform, from intake to remediation and disclosure. The role is based in Foster City, CA with in-office requirement on Mon/Wed/Fri.

You will triage, reproduce, and document findings while coordinating across engineering and security teams. We value experience with OWASP, cloud security, bug bounty programs, and CVE processes.

Qualifications

• Experience running or triaging bug bounty programs (HackerOne preferred).
• Ability to triage, validate, reproduce vulnerabilities independently.
• Strong knowledge of web/app/cloud vulnerability classes and OWASP Top 10.
• Familiarity with cloud platforms (GCP preferred) and SaaS architectures.
• Understanding of CI/CD workflows and software engineering fundamentals.

Responsibilities

• Manage vulnerability intake from bug bounty platforms, customer reports, scanners, and coordinated disclosure channels.
• Validate, reproduce, severity-score, document findings, and maintain clean records.
• Coordinate remediation with Engineering, SecOps, IT, SRE, and Cloud Security; track SLAs.
• Lead coordinated disclosure, CVE assignments, and customer advisories.

Skills

Bug bounty programs

Vulnerability triage

Vulnerability validation

OWASP Top 10

Cloud security

CI/CD workflows

SaaS architectures

Research communication

Tools

SIEM

Cloud Logging

Job description

Replit is seeking a PSIRT Engineer to own the vulnerability lifecycle for its cloud-native AI platform, from intake to remediation and disclosure. The role is based in Foster City, CA with in-office requirement on Mon/Wed/Fri.

You will triage, reproduce, and document findings while coordinating across engineering and security teams. We value experience with OWASP, cloud security, bug bounty programs, and CVE processes.