Product Security Engineer, Replit

• This role requires strong technical ability to reproduce vulnerabilities, deep understanding of web/app/cloud exploit classes, and experience operating bug bounty and coordinated disclosure programs
• Experience running or triaging for bug bounty programs (HackerOne ideally)
• Strong ability to triage, validate, and reproduce vulnerabilities independently
• Deep understanding of web/app/cloud vulnerability classes, OWASP Top 10, misconfigurations, authN/Z issues, etc
• Familiarity with cloud platforms (GCP preferred) and SaaS architectures
• Strong understanding of CI/CD workflows, code structure, and software engineering fundamentals
• Scripting or automation experience (Python, Go, Bash)

Desirable

• We are looking for a highly skilled PSIRT Engineer to lead the vulnerability response program for Replit’s cloud-native AI platform
• You will own the lifecycle of security vulnerabilities affecting our products and services—from intake to validation, remediation coordination, and public disclosure
• You will work closely with Engineering, Cloud Security, SecOps, SRE, and IT teams to ensure vulnerabilities are fixed quickly and communicated responsibly
• Manage intake from bug bounty platforms (HackerOne preferred), customer reports, automated scanners, pentest reports, and coordinated disclosure channels
• Independently validate, reproduce, severity-score, and document findings
• Identify duplicates and maintain a clean vulnerability records pipeline
• Assess relevance and exploitability using OWASP, cloud misconfiguration patterns, and identity/authentication/authorization risks (Oauth, OIDC)
• Work with Engineering, SecOps, IT, SRE, and Cloud Security to confirm product impact and drive remediation
• Provide detailed reproduction steps, proof-of-concepts, and technical analyses
• Track SLAs, remediation progress, regression testing, and systemic improvements
• Support SOC 2, ISO 27001, and pentest evidence needs as part of vulnerability lifecycle governance
• Design and evolve the bug bounty program, including scope, rules, and reward structures
• Manage platform selection, private vs. public launches, and community engagement
• Communicate clearly with researchers, provide clarifications, and handle feedback or disputes
• Determine reward payouts, bonus decisions, and recognition for top contributors
• Lead the coordinated vulnerability disclosure process for internal and external findings
• Negotiate disclosure timelines with researchers and partners
• Coordinate CVE assignments and publications, and prepare customer/public advisories