Senior Security Engineer, Bug Bounty

In this role you help safeguard the open internet by owning Mozilla’s web bug bounty program and collaborating with product and SIRT teams to mitigate security risks. You’ll interface with external researchers, triage reports, and drive secure fixes across engineering. You’ll shape program strategy, tooling, and incident-driven improvements to strengthen Mozilla’s security posture. This position offers impact at scale within a mission-driven, collaborative environment.

• generous performance-based bonus plans
• medical, dental, and vision coverage
• retirement contributions with immediate vesting
• home office stipend
• annual professional development budget
• well-being stipend

• Own and scale Mozilla’s web bug bounty program, including strategy, prioritization, KPIs, and continuous improvement
• Act as primary interface with external researchers and platforms (e.g., HackerOne) to build a trusted research community
• Lead triage and technical validation of incoming reports from multiple intake channels (HackerOne, Bugzilla, email)
• Drive end-to-end vulnerability remediation with engineering teams to ensure timely fixes
• Identify root causes and systemic issues to influence secure development improvements
• Collaborate with SIRT on active incidents and post-incident reviews
• Perform targeted code reviews (JavaScript and Python) during investigations and high-risk changes
• Develop or leverage tooling to improve triage efficiency, signal quality, and program insights

• 3+ years in a security engineering role
• Experience operating bug bounty programs, including enhancements, automation and scaling
• Practical experience with modern cloud technologies (AWS, GCP, Heroku, Azure)
• Experience analyzing code and systems to move from vulnerability to root cause prevention
• Real-world software development or engineering operations experience
• Ability to develop tools in multiple programming languages (e.g., Python, Go, Rust, JavaScript) is a plus
• Strong communication, collaboration, and problem-solving skills
• Growth mindset and practical, real-world experience over formal credentials

• strong communication
• collaboration
• problem-solving
• bug bounty program management
• cloud platforms (AWS, GCP, Heroku, Azure)
• code review and static/dynamic analysis