Intermediate Security Analyst, Vulnerability Operations

Job Description:

• Triage incoming bug bounty reports by reviewing quality, validating findings, assessing impact, identifying duplicates, and routing reports
• Triage vulnerabilities from vulnerability management activities and track them through assessment, remediation, and closure
• Work with PSIRT engineers and development teams to gather technical details, reproduce issues, and clarify affected products, versions, and configurations
• Support severity assessment using CVE, CVSS, CWE, and OWASP frameworks and terminology
• Communicate with security researchers involved in coordinated vulnerability disclosure and bug bounty programs
• Prepare information for CVE assignment and maintain accurate records as a CVE Numbering Authority
• Represent GitLab as an acting CNA representative in CVE-related discussions and operations
• Draft and coordinate customer-facing communications about vulnerabilities, fixes, mitigations, and releases
• Maintain issue records, timelines, researcher communications, remediation status, and follow-up actions
• Monitor queues and operational metrics to identify trends, aging items, recurring issues, and improvement opportunities
• Create and improve runbooks, procedures, templates, and documentation
• Participate in incident handoffs, root cause analysis documentation, lessons-learned activities, and product security reviews
• Build expertise in PSIRT, bug bounty, vulnerability management, and coordinated vulnerability disclosure

Requirements:

• Early-career experience or equivalent education in cybersecurity, software engineering, information technology, or a related field
• Foundational understanding of software vulnerabilities and security concepts, including web applications, APIs, CI/CD environments, authentication, and authorization
• Familiarity with CVE, CVSS, CWE, OWASP Top 10, and coordinated vulnerability disclosure
• Strong attention to detail and ability to organize and prioritize multiple reports or work items
• Clear written and verbal communication skills, with ability to explain technical topics to technical and non-technical audiences
• Experience with a bug bounty or vulnerability disclosure platform such as HackerOne or Bugcrowd
• Experience reviewing security reports, participating in capture-the-flag exercises, performing vulnerability research, or working with security tooling
• Familiarity with CVE assignment, CNA processes, security advisories, or vulnerability databases
• Basic scripting, log analysis, issue tracking, or data analysis experience is nice to have
• Experience writing technical documentation, customer communications, support responses, or operational procedures is nice to have

Benefits:

• Benefits to support your health, finances, and well-being
• Flexible Paid Time Off
• Team Member Resource Groups
• Equity Compensation & Employee Stock Purchase Plan
• Growth and Development Fund
• Parental Leave