Application Security Engineer

Job Summary

Bugcrowd hires an Application Security Engineer (ASE) to triage and validate security vulnerability submissions from our bug bounty programs, working with some of the world’s largest companies. The ASE will assess each submission for validity, accuracy, and severity, communicate with clients and researchers for additional information, and trigger the Incident Response process for high‑severity bugs.

• Triage incoming vulnerability submissions and determine validity, accuracy, and severity.
• Communicate directly with Bugcrowd clients and researchers to request additional details or clarification.
• Escalate and report highest‑severity bugs to clients as part of incident response.
• Utilize OWASP Top Ten and other common vulnerability types (XSS, SQLi, XXE, IDOR, SSTI, SSRF, etc.).
• Assist with the design or development of scripting or tooling to improve triage and validation workflows.
• Collaborate with the Director of Technical Operations and the broader Bugcrowd team.

• Bachelor’s degree in computer science, information security, or related field, or equivalent security consulting experience.
• Published or demonstrated passion for security assessment and research.
• High proficiency with Burp Suite (or similar interception proxy) and experience with industry‑standard tools such as Nmap, sqlmap, and the Kali Linux suite.
• Strong scripting or development skills in at least one language to aid tooling.
• Excellent organization, influencing, and communication skills.
• Ability to work independently on individual projects while contributing to team objectives.

Remote, work‑from‑home position. Must perform physical requirements such as sitting or standing for 50% of the time and carrying a laptop as needed.

Bugcrowd is committed to full inclusion of all qualified individuals. Reasonable accommodations will be provided for people with disabilities. Bugcrowd is an Equal Opportunity Employer and does not discriminate on the basis of race, color, religion, national origin, age, sex, marital status, ancestry, physical or mental disability, veteran status, gender identity, or sexual orientation.

This position requires a background check, including Social Security verification, prior employment verification, references, educational verification, and criminal history. Applicants with conviction histories will not be excluded to the extent required by law.

All application information will be processed in compliance with Bugcrowd’s Privacy Policy.