PSIRT Lead — Vulnerability Lifecycle & Bug Bounty

Replit; California (MO); On-site; USD 150,000 - 210,000; Full time

Benefits offered by this job

Competitive Salary & Equity

401(k) Program with 4% match (US Only)

Health, Dental, Vision and Life Ins.

Short/Long Term Disability

Parental, Medical, Caregiver Leave

Flexible Time Off (FTO) + Holidays

Commuter Benefits (In-Office & US Only

Monthly Wellness Stipend

Autonomous Work Environment

In Office Set-Up Reimbursement

Quarterly Team Gatherings

In Office Amenities (In-Office Only)

Job summary

Replit is seeking a PSIRT Engineer to lead the vulnerability response program for our cloud-native AI platform. You will own the lifecycle from intake to validation, remediation coordination, and public disclosure.

This role requires strong capability to reproduce vulnerabilities and manage bug bounty workflows, with close collaboration across Engineering, SecOps, and SRE teams. You will work on vulnerability intake, triage, and validation, assess exploitability using OWASP and cloud patterns,

Qualifications

• Experience triaging bug bounty programs (prefer HackerOne).
• Ability to triage, validate, reproduce vulnerabilities independently.
• Deep understanding of web/app/cloud vulnerability classes and OWASP Top 10.
• Familiarity with cloud platforms (GCP preferred) and SaaS architectures.

Responsibilities

• Vulnerability intake, triage, and validation from multiple sources.
• Provide detailed reproduction steps, proof-of-concepts, and analyses.
• Coordinate remediation with Eng/SecOps/SRE/IT and track SLAs.
• Lead coordinated disclosure and CVE management processes.

Skills

Bug bounty programs

Vulnerability triage & reproduction

OWASP Top 10

Cloud platforms (GCP preferred)

CI/CD familiarity

SaaS architectures

Incident response

Automation scripting (Python/Go/Bash)

Tools

HackerOne

Job description

Replit is seeking a PSIRT Engineer to lead the vulnerability response program for our cloud-native AI platform. You will own the lifecycle from intake to validation, remediation coordination, and public disclosure.

This role requires strong capability to reproduce vulnerabilities and manage bug bounty workflows, with close collaboration across Engineering, SecOps, and SRE teams. You will work on vulnerability intake, triage, and validation, assess exploitability using OWASP and cloud patterns,