Security Analyst – Bug Bounty Triage

About the role

As a Security Analyst in the Bug Bounty Services practice, you will be the first line of validation for vulnerability submissions, working closely with the researcher community and enterprise clients to reproduce, assess and report findings.

Key responsibilities

• Reproduce reported vulnerabilities in a controlled environment to confirm their validity.
• Ensure validated reports meet quality standards for clarity, accuracy and reproducibility before escalation.
• Communicate professionally with security researchers, requesting additional information and providing clarification.
• Communicate clearly with enterprise clients, delivering technical details in a professional manner.
• Identify and appropriately handle out‑of‑scope reports, duplicates and low‑quality submissions.
• Manage client queues to meet agreed response and validation timeframes.
• Author and deliver high‑quality vulnerability reports according to client specifications.
• Contribute to projects that improve tooling, operational processes and delivery quality.

Required profile

• Excellent written and verbal communication skills.
• Proven experience in web application, network and mobile application security testing.
• Strong knowledge of the OWASP Top 10.
• Recent professional experience using a programming or scripting language such as Python or JavaScript.
• Experience with vulnerability disclosure and bug bounty programs.
• Additional experience in vulnerability management, software QA, or SAST/DAST tools is a plus.

Required skills

• Python
• JavaScript
• OWASP Top 10
• SAST
• DAST

What we offer

• Flexible working options.
• 25 days holiday plus bank holidays, with the ability to purchase up to 5 additional days.
• Medical and critical illness coverage.