Security Analyst, Attack Surface Management

Role Overview

Responsibilities

• Triage and validate Bugcrowd submissions by reproducing issues, confirming or rejecting them, deduplicating known findings, and determining severity.
• Assess impact independently using exploitability, exposure, data sensitivity, authentication requirements, and existing controls.
• Track High and Medium findings through remediation, retesting, and closure verification.
• Document compensating controls and set expiry conditions when immediate fixes are not viable.
• Write remediation guidance that application and platform engineers can act on directly.
• Escalate Critical findings to Incident Response with reproduction details and blast-radius assessment.
• Partner with application owners and product teams on timelines and escalate delayed risk acceptance decisions.
• Monitor externally exposed assets and flag newly surfaced attack surface for assessment.

Required Qualifications

• At least two years of experience in application security, vulnerability management, penetration testing, or bug bounty work.
• Working proficiency in web application and API penetration testing, including independent reproduction and validation of findings.
• Practical knowledge of OWASP Top 10 and OWASP API Security Top 10 and their remediation approaches.
• Familiarity with MITRE ATT&CK techniques and attacker finding chains.
• Ability to determine severity beyond a CVSS calculator using business and technical context.
• Hands-on experience with Burp Suite and standard web and API testing tools.
• Clear written communication for persuading engineering teams that findings are real and actionable.

Preferred Qualifications

• A bug bounty track record on Bugcrowd, HackerOne, or Intigriti is preferred.
• Experience triaging submissions from the program side is preferred.
• Cloud security exposure across AWS or Azure, particularly identity and storage misconfigurations, is preferred.
• Certifications such as BSCP, OSWA, OSCP, CPTS, or PNPT are preferred, with a public bug bounty profile carrying equal weight.

Additional Skill

• Python scripting is used for reproduction harnesses and finding automation.