Senior Security Engineer, Bug Bounty

Mozilla Corporation is the non-profit-backed technology company that has shaped the internet for the better over the last 25 years. As a Security Engineer, you'll protect the internet by managing the Mozilla Web Bug Bounty program and collaborating with teams to mitigate security risks.

Responsibilities:

• Own and scale Mozilla's web bug bounty program, including strategy, prioritization, KPIs, and continuous improvement
• Act as the primary interface with external researchers and platforms (e.g., HackerOne), fostering a high-quality and trusted research community
• Lead triage and technical validation of incoming reports across multiple intake channels (HackerOne, Bugzilla, email)
• Drive end-to-end vulnerability remediation, partnering with engineering teams to ensure timely, effective fixes
• Identify root causes and systemic issues, and influence long-term improvements in secure development practices
• Collaborate with the Security Incident Response Team (SIRT) on active incidents and post-incident reviews
• Perform targeted code reviews (primarily JavaScript and Python) during investigations and high-risk changes
• Develop or leverage tooling to improve triage efficiency, signal quality, and program insights

Requirements:

• 3+ years of demonstrated ability in a security engineering role
• Experience operating bug bounty programs, including enhancements, automation and scaling, and/or bug hunting
• Practical experience working with modern cloud technologies (eg. Amazon Web Services, Google Cloud Platform, Heroku, Microsoft Azure, etc.)
• Experience analyzing code and systems to move from vulnerability root cause prevention
• Real-world experience in software development and/or engineering operations
• Strong communication, collaboration, and problem-solving skills, with the ability to influence and guide cross-functional teams
• Formal credentials are great, but real-world experience, curiosity, passion and a growth mindset matter more
• Ability to develop your own tools as needed in a variety of programming languages (eg. Python, Go, Rust, Javascript, etc.) is a plus, but not required