Senior Security Engineer (Bug Bounty)

Join Mozilla, a company dedicated to making the internet a global public resource that is open and accessible to all. As a Senior Security Engineer, you will own and manage the Mozilla Web Bug Bounty program, ensuring risk mitigation of security incidents and events. You will act as the primary interface with external researchers and platforms, lead triage and technical validation of incoming reports, drive end-to-end vulnerability remediation, and collaborate with the Security Incident Response Team. You will also have access to a range of benefits, including health and wellness coverage, mental health support, time away from work, parental leave, financial benefits, learning and development opportunities, and more.

• Own and scale Mozilla’s web bug bounty program, including strategy, prioritization, KPIs, and continuous improvement.
• Act as the primary interface with external researchers and platforms (e.g., HackerOne), fostering a high-quality and trusted research community.
• Lead triage and technical validation of incoming reports across multiple intake channels (HackerOne, Bugzilla, email).
• Experience operating bug bounty programs, including enhancements, automation and scaling, and/or bug hunting
• Formal credentials are great, but real-world experience, curiosity, passion and a growth mindset matter more
• Ability to develop your own tools as needed in a variety of programming languages (eg. Python, Go, Rust, Javascript, etc.) is a plus, but not required
• 3+ years of demonstrated ability in a security engineering role
• Practical experience working with modern cloud technologies (eg. Amazon Web Services, Google Cloud Platform, Heroku, Microsoft Azure, etc.)
• Experience analyzing code and systems to move from vulnerability → root cause → prevention
• Strong communication, collaboration, and problem-solving skills, with the ability to influence and guide cross-functional teams
• Real-world experience in software development and/or engineering operations