Senior Product Security Engineer, Elastic

• Are you passionate about secure software, responsible disclosure, and leading a world class, forward-thinking bug bounty program? Can you build strong working relationships with Elastic Engineering and external researchers? Then we should have a conversation!
• Proven experience managing or participating in a bug bounty or vulnerability disclosure program, preferably for a technology or software company
• Hands-on background in application security, vulnerability assessment, or penetration testing, with experience analyzing security vulnerabilities and driving remediation efforts across engineering teams
• Demonstrated ability to engage and communicate effectively with external security researchers and technical stakeholders
• Familiarity with secure software development practices and common security frameworks (e.g. SSDF, OWASP, ISO 27001)
• Strong organizational skills and the ability to manage multiple priorities, and deadlines in a fast-paced environment
• Outstanding spoken and written communication skills and comfort operating in an asynchronous globally distributed environment

Desirable

• We’re always searching for outstanding people who have a real passion for what they do and are masters at their craft!
• We are looking for a Senior Product Security Engineer to help drive the growth and maturity of our Bug Bounty Program, bringing the wisdom and expertise of researchers in the hacker community to Elastic products
• The InfoSec Product Security team is accountable for the security of all Elastic software and cloud services. We foster customer trust and empower Elastic to weave security into the fabric of our product development and Elastic Cloud platforms
• In a globally distributed company, we think differently about achieving critical security and compliance objectives
• Lead and mature the bug bounty program for a variety of sophisticated software products, including the world's most deployed open source vector database
• Engage with the security external community to attract and retain world class security researchers, fostering a culture of mutual trust and collaboration
• Operate a transparent and equitable process for evaluating and rewarding security findings, reinforcing Elastic’s reputation for integrity
• Collaborate with engineering teams to ensure timely and efficient remediation of vulnerabilities
• Champion a data-driven approach to security, ensuring lessons learned from the bug bounty program lead to measurable risk reduction by proactively addressing repeat exposures and strengthening security controls
• Effectively communicate to team partners and senior leadership on progress and drive decisions to address program and project challenges