Information Security Analyst - (Penetration Tester)We are seeking an experienced Information Security Analyst with a strong penetration testing background to support the automation and scaling of an enterprise Bug Bounty program. This role will focus on validating and triaging security findings, partnering with development teams on remediation efforts, and leveraging AI-assisted tools to improve vulnerability assessment and prioritization processes.
Key Responsibilities- Perform web application and infrastructure penetration testing activities.
- Validate, reproduce, and triage vulnerabilities submitted through the organization's Bug Bounty program.
- Identify false positives, duplicate submissions, and legitimate security findings.
- Evaluate and prioritize vulnerabilities using industry-standard frameworks such as CVSS, DREAD, or similar methodologies.
- Partner closely with software engineers and infrastructure teams to provide remediation guidance and secure coding recommendations.
- Track and manage findings through vulnerability management and ticketing platforms.
- Leverage scripting, automation, APIs, and AI-assisted workflows to improve testing and validation processes.
- Interface with external security researchers and Bug Bounty platforms to assess and validate reported findings
Required Qualifications- 6-10 years of information security experience with a focus on penetration testing.
- Experience performing web application penetration testing.
- Experience conducting infrastructure security testing and vulnerability assessments.
- Experience using CVSS, DREAD, or similar risk-ranking frameworks.
- Experience partnering with development teams to remediate vulnerabilities and provide secure coding guidance.
- Experience validating and reproducing Bug Bounty findings
- Familiarity with vulnerability management and ticketing platforms such as ServiceNow, Jira, Azure DevOps, or similar tools.
- Experience with Python, PowerShell, APIs, automation tooling, or AI-assisted security workflows.
Preferred Qualifications- Experience working with Bug Bounty platforms and external security researchers.
- Experience leveraging AI-enabled security testing and validation tools.
- Knowledge of secure software development practices and application security principles.
- Experience using GitHub Copilot or similar AI-assisted development and security tools.
CertificationsThe following industry-recognized certifications are highly desired:
- GPEN
- OSCP
- PenTest+
- Equivalent penetration testing certifications
