Product Security Engineer - Bug Bounty

Company: GitHub
Location: Austin
Posted on: April 8, 2021

Job Description:

GitHub is changing the way the world builds secure software and we want you to help us secure GitHub. We're looking for a bug bounty security engineer to help us manage GitHub's Bug Bounty Program. GitHub's Bug Bounty Program is a collaborative effort with third party researchers where researchers are rewarded for discovering security bugs in GitHub's products and infrastructure. In this support role, you will be responsible for first level triage and tracking the resolution of Bug Bounty submissions. This includes coordinating efforts between external bounty researchers and internal GitHub staff members across a variety of teams. Communication and empathy is key in this role, and your collaboration with security researchers and other GitHub staff members is crucial to the success of GitHub's bounty program. In this role you'll need to be thorough in the analysis and validation of reported vulnerabilities, decipher and disseminate researcher-provided information into actionable information for internal consumption, track and organize multiple remediation efforts of bounty submissions, and interface regularly with other members of the AppSec team on trends and overall bounty program related items. Lastly, in support of the promotion of GitHub's Bug Bounty Program this role will include some marketing elements such as working with GitHub's communications team to draft promotion materials, coordinating within our VIP program, and assisting with Bug Bounty hacking events. Responsibilities: --- Managing day-to-day triage of Bug Bounty reports--- Communicating with third-party researchers--- Collaborating with the AppSec team for further vulnerability analysis--- Collaborating with engineers to track vulnerability resolution--- Assisting with the marketing materials and promotion of GitHub's Bounty program--- Collaborate on Bug Bounty disclosures with the GitHub Communications team Minimum Qualifications: --- Excellent written and verbal communication skills--- Understanding of basic application security principles, best practices and common web security vulnerabilities--- Familiarity with common network protocols and standards such as DNS and TCP/IP--- Familiarity with application security testing processes and tooling Bonus points if you have: --- Experience triaging bounty reports or support tickets--- Experience as a Bug Bounty researcher--- Experience automating processes--- Practical software development experience--- Web security related certifications--- Experience utilizing GitHub product features, such as GitHub Actions Who We Are: GitHub is the developer company. We make it easier for developers to be developers: to work together, to solve challenging problems, and to create the world's most important technologies. We foster a collaborative community that can come together-as individuals and in teams-to create the future of software and make a difference in the world. Leadership Principles: Customer Obsessed - Trust by Default - Ship to Learn - Own the Outcome - Growth Mindset - Global Product, Global Team - Anything is Possible - Practice Kindness Why You Should Join: At GitHub, we constantly strive to create an environment that allows our employees (Hubbers) to do the best work of their lives. We've designed one of the coolest workspaces in San Francisco (HQ), where many Hubbers work, snack, and create daily. The rest of our Hubbers work remotely around the globe. Check out an updated list of where we can hire here: We are also committed to keeping Hubbers healthy, motivated, focused and creative. We've designed our top-notch benefits program with these goals in mind. In a nutshell, we've built a place where we truly love working, we think you will too. GitHub is made up of people from a wide variety of backgrounds and lifestyles. We embrace diversity and invite applications from people of all walks of life. We don't discriminate against employees or applicants based on gender identity or expression, sexual orientation, race, religion, age, national origin, citizenship, disability, pregnancy status, veteran status, or any other differences. Also, if you have a disability, please let us know if there's any way we can make the interview process better for you; we're happy to accommodate! Please note that benefits vary by country. If you have any questions, please don't hesitate to ask your Talent Partner.

Keywords: GitHub, Austin , Product Security Engineer - Bug Bounty, Engineering , Austin, Texas