Senior Product Security Engineer: Bug Bounty & Remediation

Socket.dev; San Jose, Northern (CA, KY); Hybrid; USD 181,000 - 261,000; Full time

Job summary

Adobe seeks a Senior Product Security Engineer to triage external vulnerability reports submitted via Bug Bounty, reproduce PoCs, and assign CVSS scores. You will work with product teams to ensure timely remediation and develop dashboards to monitor progress.

You will apply OWASP Top 10 knowledge and LLM/AI security testing expertise to validate findings and communicate clearly with researchers and internal teams.

Qualifications

• Bachelor’s degree in Computer Science, Engineering or related field, plus 5+ years relevant experience.
• Strong knowledge of application security vulnerabilities (OWASP Top 10) and mitigation.
• Hands-on experience with CVSS v3.1 scoring.

Responsibilities

• Triage, validate and reproduce vulnerability reports from Bug Bounty submissions.
• Assign CVSS scores and severity using internal guidelines.
• Reproduce PoC exploits across web, API and mobile surfaces.
• Communicate with external researchers and manage expectations.
• Coordinate with engineering teams to route confirmed issues for remediation.
• Identify duplicates, out-of-scope, or informational reports and document rationale.
• Contribute to triage runbooks and severity calibration guidelines.
• Flag systemic findings to Bug Bounty team as needed.
• Develop PowerBI dashboards to support data-driven remediation.

Skills

OWASP Top 10

Vulnerability testing

PoC reproduction

Written communication

LLM testing

Python scripting

Automation experience

Security incident triage

Education

Bachelor’s degree or equivalent in CS/Engineering

Tools

Burp Suite

DevTools

curl

JIRA

PowerBI

OpenAPI/Swagger

AWS Lambda / API Gateway

Job description

Adobe seeks a Senior Product Security Engineer to triage external vulnerability reports submitted via Bug Bounty, reproduce PoCs, and assign CVSS scores. You will work with product teams to ensure timely remediation and develop dashboards to monitor progress.

You will apply OWASP Top 10 knowledge and LLM/AI security testing expertise to validate findings and communicate clearly with researchers and internal teams.