Bugcrowd jobs, judged for you, free

What they do

Bugcrowd runs a security platform that brings hackers, penetration testers, and AI together. It finds what is exposed, what attackers can exploit, and what to fix first. Services include bug bounty programs, penetration testing, vulnerability disclosure, red teaming, and attack surface management. In a bug bounty, customers pay only for results. Bugcrowd started in 2012.

What they value

• 360 degree accountability: every team member counts and pitches in.
• Build it like you own it: take ownership of, and pride in, the work.
• Think like a hacker: take things apart to make them better.
• Simple is strong: look for the simplest, strongest solution.
• Respect is key: treat customers, hackers, and colleagues with respect.
• Happy customers: give the best experience on the platform and in every interaction.

Where they hire

Twelve of the 13 roles are fully remote: seven in the US, two in India, and one each in Brazil, Mexico, and Costa Rica. One role in Huntsville, Alabama, is hybrid and needs an active secret security clearance. The two Application Security Engineer roles are five-month contracts. One role prefers a US Person under US defense export rules (ITAR).

Teams and roles

Bugcrowd has its headquarters in San Francisco and an office in New Hampshire. General Catalyst, Rally Ventures, and Costanoa Ventures back it. The board lists 13 roles.

• Engineering: a Senior Full Stack Engineer leads a new product in TypeScript, React, and LLM agents. A Staff Software Engineer in Huntsville builds external attack surface management. An Embedded Systems Staff Engineer owns ARM and AArch64 emulation for binary analysis. A Reinforcement Learning Engineer builds cybersecurity test environments for frontier AI labs such as Anthropic and OpenAI, with Bugcrowd's Mayhem analysis platform.
• Security operations: Application Security Engineers triage and validate bug reports sent to customer bug bounty programs. A manager leads a team of Security Consultants.
• Product security: three Product Security Engineers, in India, Mexico, and Costa Rica, secure Bugcrowd's own products.
• Other roles: a federal Customer Experience Manager, a Customer Support Engineer, and a Product Marketing Manager.

Every US Posting gives a pay range. For example, the Senior Full Stack Engineer range is $140,400 to $175,500. The Embedded Systems Staff Engineer role gives an hourly rate.

What they look for

Most roles ask for 3 or more years. Senior and staff engineers need 5 to 7 or more. The Customer Support Engineer role asks for 0 to 2 years. Several security roles want a strong grasp of common vulnerability classes, such as the OWASP Top 10. Application Security Engineers need Burp Suite and tools such as nmap and sqlmap. The security operations manager role prefers OSCP or a similar certificate. Full stack roles ask for TypeScript, React, Next.js, and PostgreSQL. Low-level roles ask for C or C++ on Linux.

Roles with access to confidential information need a background check.