Intermediate Security Analyst, Vulnerability Operations (North America)

Overview

Support product security vulnerability operations by triaging reports, coordinating remediation, and communicating with researchers, customers, and internal teams.

What you'll do

• Triage bug bounty reports and validate findings, impact, duplicates, and routing.
• Track vulnerabilities through assessment, remediation, and closure.
• Gather technical details and reproduce issues with engineering teams.
• Support severity assessment using CVE, CVSS, CWE, and OWASP terminology.
• Prepare CVE assignment information and support CNA operations.
• Coordinate customer-facing communications about vulnerabilities, fixes, and mitigations.
• Maintain records, monitor operational metrics, and improve runbooks and procedures.

What you'll need

• Early-career experience or equivalent education in cybersecurity, software engineering, information technology, or a related field.
• Foundational understanding of vulnerabilities, web applications, APIs, CI/CD, authentication, and authorization.
• Familiarity with CVE, CVSS, CWE, OWASP Top 10, and coordinated vulnerability disclosure.
• Strong attention to detail and ability to prioritize multiple work items.
• Clear written and verbal communication skills for technical and non-technical audiences.
• Experience with HackerOne, Bugcrowd, security reports, capture-the-flag exercises, vulnerability research, or security tooling.
• Familiarity with CVE assignment, CNA processes, security advisories, or vulnerability databases.

Nice to have

• Basic scripting, log analysis, issue tracking, or data analysis experience.
• Experience writing technical documentation, customer communications, support responses, or operational procedures.

Details

• Remote role open to candidates in Canada and the United States.
• Applicants in West Coast US or British Columbia are encouraged.
• Base salary for US residents: USD 115,000–150,000 yearly.
• Full-time employment.