Security Analyst, Attack Surface Management

Role overview

Responsibilities

• Triage and validate Bugcrowd submissions through reproduction, confirmation, deduplication, and severity assessment.
• Assess impact using exploitability, asset exposure, data sensitivity, authentication requirements, and existing controls.
• Track findings from red team engagements and adversary simulations through remediation, retesting, and closure.
• Evaluate compensating controls, document them, and set expiry conditions for exceptions.
• Write actionable remediation guidance for application and platform engineers.
• Escalate Critical findings to Incident Response with reproduction details and blast-radius assessments.
• Partner with application and product teams on remediation timelines and escalate delayed risk acceptance decisions.
• Monitor externally exposed assets and flag newly surfaced attack surface for assessment.
• Use Python for reproduction harnesses and finding automation.

Required qualifications

• At least two years of experience in application security, vulnerability management, penetration testing, or bug bounty work.
• Working proficiency in web application and API penetration testing.
• Practical knowledge of OWASP Top 10 and OWASP API Security Top 10.
• Familiarity with MITRE ATT&CK techniques and attacker chaining.
• Ability to determine severity beyond CVSS using exploitability, exposure, data sensitivity, authentication, and controls.
• Hands-on experience with Burp Suite and standard web and API testing tools.
• Clear written communication for explaining findings and remediation priorities.

Preferred qualifications

• Bug bounty experience on Bugcrowd, HackerOne, or Intigriti is preferred.
• Program-side submission triage experience is preferred.
• Cloud security exposure across AWS or Azure is preferred.
• Certifications such as BSCP, OSWA, OSCP, CPTS, or PNPT are preferred. A public bug bounty profile carries equal weight.