Key skills
Security EngineeringBug Bounty Program ManagementVulnerability TriageTechnical ValidationVulnerability RemediationSecure Development PracticesSecurity Incident ResponseCode Review - JavaScriptCode Review - PythonCloud Technologies - Amazon Web ServicesCloud Technologies - Google Cloud PlatformCloud Technologies - HerokuCloud Technologies - Microsoft AzureSoftware DevelopmentProgramming - PythonProgramming - GoProgramming - RustProgramming - JavaScriptJavaScriptPythonGoRustAmazon Web ServicesAzureGoogle CloudHerokuCommunicationCollaboration
About this role
Mozilla Corporation is the non-profit-backed technology company that has shaped the internet for the better over the last 25 years. As a Security Engineer, you'll protect the vision of an open and accessible internet by managing the Mozilla Web Bug Bounty program and collaborating with product and SIRT teams to mitigate security risks.
Responsibilities:
- Own and scale Mozilla’s web bug bounty program, including strategy, prioritization, KPIs, and continuous improvement
- Act as the primary interface with external researchers and platforms (e.g., HackerOne), fostering a high-quality and trusted research community
- Lead triage and technical validation of incoming reports across multiple intake channels (HackerOne, Bugzilla, email)
- Drive end-to-end vulnerability remediation, partnering with engineering teams to ensure timely, effective fixes
- Identify root causes and systemic issues, and influence long-term improvements in secure development practices
- Collaborate with the Security Incident Response Team (SIRT) on active incidents and post-incident reviews
- Perform targeted code reviews (primarily JavaScript and Python) during investigations and high-risk changes
- Develop or leverage tooling to improve triage efficiency, signal quality, and program insights
Requirements:
- 3+ years of demonstrated ability in a security engineering role
- Experience operating bug bounty programs, including enhancements, automation and scaling, and/or bug hunting
- Practical experience working with modern cloud technologies (eg. Amazon Web Services, Google Cloud Platform, Heroku, Microsoft Azure, etc.)
- Experience analyzing code and systems to move from vulnerability → root cause → prevention
- Real-world experience in software development and/or engineering operations
- Strong communication, collaboration, and problem-solving skills, with the ability to influence and guide cross-functional teams
- Formal credentials are great, but real-world experience, curiosity, passion and a growth mindset matter more
- Ability to develop your own tools as needed in a variety of programming languages (eg. Python, Go, Rust, Javascript, etc.) is a plus, but not required