Vulnerability Operations Analyst — Bug Bounty Triage & CVE

GitLab; United States; Remote; USD 120,000 - 180,000; Full time

Job summary

GitLab is the intelligent orchestration platform for DevSecOps, enabling organizations to increase developer productivity and reduce security risk. The Product Security Vulnerability Operations team ensures GitLab delivers secure applications and governs vulnerability policies.

Team members collaborate across regions using documented processes, automation, and structured handoffs. The team serves as a central point of contact for external security researchers and supports ongoing operational

Qualifications

• Foundational understanding of software vulnerabilities and security concepts like web applications, APIs, and CI/CD.
• Familiarity with CVE assignment, CNA processes, and vulnerability databases.
• Clear written and verbal communication skills for both technical and non-technical audiences.

Responsibilities

• Triage incoming bug bounty reports, assess validity and impact, and route to appropriate teams.
• Support severity assessment using CVE, CVSS, CWE, and OWASP frameworks.
• Draft customer-facing communications and maintain accurate issue records.

Skills

Vulnerability management

Security concepts

Web applications

APIs

CI/CD basics

Technical communication

Tools

CVE assignment

CNA processes

Vulnerability databases

Job description

GitLab is the intelligent orchestration platform for DevSecOps, enabling organizations to increase developer productivity and reduce security risk. The Product Security Vulnerability Operations team ensures GitLab delivers secure applications and governs vulnerability policies.

Team members collaborate across regions using documented processes, automation, and structured handoffs. The team serves as a central point of contact for external security researchers and supports ongoing operational