Mozilla Corporation is a non-profit-backed technology company focused on open-source software and privacy. We are hiring a Senior Security Engineer to own, manage, and scale the Mozilla Web Bug Bounty program and collaborate with Mozilla product teams and the Security Incident Response Team (SIRT) to mitigate security incidents and improve secure development practices. What you’ll do: Own and scale Mozilla’s web bug bounty program, including strategy, prioritization, KPIs, and continuous improvement. Serve as the primary interface with external researchers and platforms (e.g., HackerOne), fostering a high-quality, trusted research community. Lead triage and technical validation of incoming reports across multiple channels (HackerOne, Bugzilla, email). Drive end-to-end vulnerability remediation, partnering with engineering teams to ensure timely, effective fixes. Identify root causes and systemic issues, influencing long-term improvements in secure development practices. Collaborate with SIRT on active incidents and post-incident reviews. Perform targeted code reviews (primarily JavaScript and Python) during investigations and high-risk changes. Develop or leverage tooling to improve triage efficiency, signal quality, and program insights. What you’ll bring: 3+ years of demonstrated experience in a security engineering role. Experience operating bug bounty programs, including enhancements, automation, scaling, and/or bug hunting. Practical experience with modern cloud technologies (e.g., AWS, Google Cloud Platform, Heroku, Microsoft Azure). Experience analyzing code and syst

Mozilla Corporation is a non-profit-backed technology company focused on open-source software and privacy. We are hiring a Senior Security Engineer to own, manage, and scale the Mozilla Web Bug Bounty program and collaborate with Mozilla product teams and the Security Incident Response Team (SIRT) to mitigate security incidents and improve secure development practices. What you’ll do: Own and scale Mozilla’s web bug bounty program, including strategy, prioritization, KPIs, and continuous improvement. Serve as the primary interface with external researchers and platforms (e.g., HackerOne), fostering a high-quality, trusted research community. Lead triage and technical validation of incoming reports across multiple channels (HackerOne, Bugzilla, email). Drive end-to-end vulnerability remediation, partnering with engineering teams to ensure timely, effective fixes. Identify root causes and systemic issues, influencing long-term improvements in secure development practices. Collaborate with SIRT on active incidents and post-incident reviews. Perform targeted code reviews (primarily JavaScript and Python) during investigations and high-risk changes. Develop or leverage tooling to improve triage efficiency, signal quality, and program insights. What you’ll bring: 3+ years of demonstrated experience in a security engineering role. Experience operating bug bounty programs, including enhancements, automation, scaling, and/or bug hunting. Practical experience with modern cloud technologies (e.g., AWS, Google Cloud Platform, Heroku, Microsoft Azure). Experience analyzing code and syst