ZipRecruiter

Log In

1

Bug Bounty Program Jobs in Arizona (NOW HIRING)

SmartRent

Application Security Engineer

Phoenix, AZ · On-site

$58.25 - $78/hr

Experience managing or supporting vulnerability disclosure or bug bounty programs. * Strong written and verbal communication skills, with the ability to clearly communicate security requirements to ...

SmartRent

Application Security Engineer

Phoenix, AZ · On-site

$58.25 - $78/hr

Experience managing or supporting vulnerability disclosure or bug bounty programs. * Strong written and verbal communication skills, with the ability to clearly communicate security requirements to ...

SmartRent

Application Security Engineer

Phoenix, AZ · On-site

$58.25 - $78/hr

Experience managing or supporting vulnerability disclosure or bug bounty programs. * Strong written and verbal communication skills, with the ability to clearly communicate security requirements to ...

SmartRent

Application Security Engineer

Phoenix, AZ · On-site

$58.25 - $78/hr

Experience managing or supporting vulnerability disclosure or bug bounty programs. * Strong written and verbal communication skills, with the ability to clearly communicate security requirements to ...

All JobsBug Bounty Program JobsBug Bounty Program Jobs in Arizona

Bug Bounty Program information

What is a bug bounty program?

A Bug Bounty Program is an initiative offered by organizations that invites ethical hackers and security researchers to identify and report vulnerabilities in the company’s software, websites, or systems. Participants are typically rewarded with monetary compensation, recognition, or other incentives based on the severity of the bugs they find. These programs help organizations strengthen their security by leveraging the broader cybersecurity community, thus identifying issues before malicious hackers can exploit them. Bug bounty programs are widely used by tech companies to enhance security and build trust with users.

What are some common challenges faced by professionals managing a bug bounty program?

Professionals overseeing a Bug Bounty Program often encounter challenges such as efficiently triaging a high volume of vulnerability reports, ensuring clear communication with security researchers, and balancing quick response times with thorough investigation. Additionally, maintaining strong relationships with both internal development teams and external participants is crucial for program success. Staying updated on evolving security threats and continually refining program policies are ongoing responsibilities that require adaptability and collaboration.

What are the key skills and qualifications needed to thrive as a bug bounty program participant, and why are they important?

To excel in a Bug Bounty Program, you need strong knowledge of cybersecurity fundamentals, vulnerability assessment, and web or software exploitation techniques, often backed by practical experience or certifications like OSCP or CEH. Familiarity with tools such as Burp Suite, Nmap, and Metasploit, as well as bug bounty platforms like HackerOne or Bugcrowd, is typically required. Critical thinking, persistence, and clear written communication are crucial soft skills for effectively identifying vulnerabilities and reporting them to organizations. These skills ensure you can discover security flaws efficiently, responsibly disclose them, and build a positive reputation in the cybersecurity community.

What is the difference between Bug Bounty Program vs Penetration Tester?

AspectBug Bounty ProgramPenetration Tester
CredentialsKnowledge of security vulnerabilities, bug reporting skillsCertifications like OSCP, CEH, CISSP often preferred
Work EnvironmentRemote, project-based, crowdsourcedConsulting firms, in-house teams, on-site or remote
Industry UsageTech companies, startups, open security initiativesSecurity firms, corporate security teams, government agencies
Search/Comparison IntentUnderstanding crowdsourced bug finding vs professional testingComparing freelance or company-based security assessments

The main difference is that Bug Bounty Programs are crowdsourced initiatives where individuals report vulnerabilities remotely, often without formal certifications. Penetration Testers are professionals with certifications who perform targeted security assessments, usually in a consulting or in-house setting. Both roles focus on identifying security flaws but differ in structure, credentials, and work environment.

What are the most commonly searched types of Bug Bounty Program jobs in Arizona?

The most popular types of Bug Bounty Program jobs in Arizona are:

What are popular job titles related to Bug Bounty Program jobs in Arizona?

For Bug Bounty Program jobs in Arizona, the most frequently searched job titles are:

What job categories do people searching Bug Bounty Program jobs in Arizona look for?

The top searched job categories for Bug Bounty Program jobs in Arizona are:

Bug Bounty Program jobs near you

Application Security Engineer

Phoenix, AZ • On-site

SmartRent
IT Services • 51 - 200 employees
Learn more about SmartRentexternal

$58.25 - $78/hr

Full-time

Re-posted 26 days ago

Job description

Job Description

The Application Security Engineer is responsible for supporting the security and privacy of the SmartRent platform through the management of information security risk, system resilience, and compliance activities. This role uses cloud-native and third-party security tools to protect company assets and data across multiple platforms.

This role partners with engineering, development, and external stakeholders to implement and maintain security policies, processes, and standards, including secure software development lifecycle (SDLC) practices. Success in this role requires strong communication skills, the ability to coordinate across multiple technical teams, and the ability to support consistent security practices across the organization.

Responsibilities

  • Develop and execute a comprehensive application security strategy aligned with business objectives and industry standards.
  • Maintain and advise on secure coding standards, security documentation, and application security processes.
  • Deliver application security and privacy training for development teams.
  • Review source code to identify security vulnerabilities, insecure patterns, secrets exposure, and risks associated with AI-generated code.
  • Triage, reproduce, and support remediation of application vulnerabilities (e.g., SQL injection, XSS, access control weaknesses) identified through automated tools (SAST, DAST, SCA) or manual analysis.
  • Manage application security workflows, including task prioritization, ticket tracking, and coordination with development and DevOps teams.
  • Maintain and enhance SmartRent's responsible disclosure and vulnerability reporting program.
  • Partner with developers to implement encryption, hashing, and secure key management practices.
  • Collaborate with developers and engineering teams to perform threat modeling, identify attack paths, and assess weaknesses.
  • Lead the investigation and mitigation of application-level security incidents, collaborating with the SOC and engineering teams to ensure rapid remediation and stakeholder communication.
  • Provide guidance on security and privacy controls for cloud infrastructure (AWS), application development, and IoT hardware.
  • Conduct regular application risk assessments to identify vulnerabilities and emerging threats.
  • Research emerging cybersecurity risks and recommend mitigation strategies as appropriate.
  • Perform adversarial testing and security validation of applications, including internal AI models and services.
  • Use cloud-native security tools to identify and secure large language model (LLM) integrations and implement appropriate security guardrails.

Required Qualifications

  • 4-6 years of experience in application security, including development and maintenance of security policies and collaboration with engineering and release teams.
  • Experience identifying and remediating application vulnerabilities across modern programming languages, including Elixir, JavaScript, Ruby, Python, or similar languages.
  • Strong knowledge of OWASP Top 10, OWASP API Top 10, and modern authentication mechanisms, including JWT and OAuth.
  • Hands-on experience with application security tools, including SAST, DAST, and SCA platforms (e.g., GHAS, Burp Suite, Fortra, or similar tools).
  • Experience working with cloud security controls, including AWS-native tools, web application firewalls (WAF), or similar technologies.
  • Experience managing or supporting vulnerability disclosure or bug bounty programs.
  • Strong written and verbal communication skills, with the ability to clearly communicate security requirements to technical teams.
  • Demonstrated problem-solving and analytical skills in identifying and mitigating application security risks.

Preferred Qualifications

  • Industry certifications such as CSSLP, GIAC GWAPT, CEH, or equivalent security certifications.
  • Experience working with CloudFlare, AWS security services, or similar cloud-native security tools.
  • Experience integrating security practices into SDLC processes.
  • Experience supporting threat modeling or application security architecture reviews.

Apply