ZipRecruiter

Log In

1

Bug Bounty Program Jobs in California (NOW HIRING)

Vercel

Product Security Engineer

San Francisco, CA · On-site +1

Own and evolve the bug bounty program: Manage the researcher-facing side (scope, policy, engagement) as well as the internal tooling, so every report gets resolved and makes the automated triage ...

MM International

Penetration Tester

San Francisco, CA · On-site

Experience in Red Teaming and bug bounty programs preferred Ideal Candidate: * 5-8 years of security testing experience * Proven ability to mentor teams and implement enterprise security solutions

Opal

Security Manager

San Francisco, CA · On-site

$120K - $200K/yr

Own bug bounty / vulnerability disclosure program operations, including intake, triage coordination, SLA tracking, and reporting * Coordinate vulnerability remediation across security vendors ...

Zip

Senior Security Engineer

San Francisco, CA · On-site

$160K - $240K/yr

Hands-on experience in offensive security (eg, through bug bounty programs or CTFs) The salary range for this role is $160,000 - $240,000. The salary for this position is determined based on a ...

Figma

Security Engineer

San Francisco, CA · Remote

Help run penetration testing, offensive security exercises, and support our bug bounty program. * Help respond to product security incidents. Anti-Abuse * Design and build technical systems to ...

HeyGen

Security Engineer

San Francisco, CA · On-site

We already run Drata for GRC, Infisical for secrets management, and a private bug bounty program via Bugcrowd. You are not starting from zero. * Autonomy and Ownership: You will have the visibility ...

next page

Showing results 1-20

All JobsBug Bounty Program JobsBug Bounty Program Jobs in California

Bug Bounty Program information

What are some common challenges faced by professionals managing a bug bounty program?

Professionals overseeing a Bug Bounty Program often encounter challenges such as efficiently triaging a high volume of vulnerability reports, ensuring clear communication with security researchers, and balancing quick response times with thorough investigation. Additionally, maintaining strong relationships with both internal development teams and external participants is crucial for program success. Staying updated on evolving security threats and continually refining program policies are ongoing responsibilities that require adaptability and collaboration.

What are the key skills and qualifications needed to thrive as a bug bounty program participant, and why are they important?

To excel in a Bug Bounty Program, you need strong knowledge of cybersecurity fundamentals, vulnerability assessment, and web or software exploitation techniques, often backed by practical experience or certifications like OSCP or CEH. Familiarity with tools such as Burp Suite, Nmap, and Metasploit, as well as bug bounty platforms like HackerOne or Bugcrowd, is typically required. Critical thinking, persistence, and clear written communication are crucial soft skills for effectively identifying vulnerabilities and reporting them to organizations. These skills ensure you can discover security flaws efficiently, responsibly disclose them, and build a positive reputation in the cybersecurity community.

What is a bug bounty program?

A Bug Bounty Program is an initiative offered by organizations that invites ethical hackers and security researchers to identify and report vulnerabilities in the company’s software, websites, or systems. Participants are typically rewarded with monetary compensation, recognition, or other incentives based on the severity of the bugs they find. These programs help organizations strengthen their security by leveraging the broader cybersecurity community, thus identifying issues before malicious hackers can exploit them. Bug bounty programs are widely used by tech companies to enhance security and build trust with users.

What is the difference between Bug Bounty Program vs Penetration Tester?

AspectBug Bounty ProgramPenetration Tester
CredentialsKnowledge of security vulnerabilities, bug reporting skillsCertifications like OSCP, CEH, CISSP often preferred
Work EnvironmentRemote, project-based, crowdsourcedConsulting firms, in-house teams, on-site or remote
Industry UsageTech companies, startups, open security initiativesSecurity firms, corporate security teams, government agencies
Search/Comparison IntentUnderstanding crowdsourced bug finding vs professional testingComparing freelance or company-based security assessments

The main difference is that Bug Bounty Programs are crowdsourced initiatives where individuals report vulnerabilities remotely, often without formal certifications. Penetration Testers are professionals with certifications who perform targeted security assessments, usually in a consulting or in-house setting. Both roles focus on identifying security flaws but differ in structure, credentials, and work environment.

What are the most commonly searched types of Bug Bounty Program jobs in California? The most popular types of Bug Bounty Program jobs in California are:
What are popular job titles related to Bug Bounty Program jobs in California? For Bug Bounty Program jobs in California, the most frequently searched job titles are:
What job categories do people searching Bug Bounty Program jobs in California look for? The top searched job categories for Bug Bounty Program jobs in California are:
What cities in California are hiring for Bug Bounty Program jobs? Cities in California with the most Bug Bounty Program job openings:
Bug Bounty Program jobs near you
Infographic showing various Bug Bounty Program job openings in California as of August 2026, with employment types broken down into 1% As Needed, 77% Full Time, 17% Part Time, 1% Temporary, and 4% Contract. Highlights an 96% Physical, 1% Hybrid, and 3% Remote job distribution.

Senior Technical Program Manager, Security

Replit

Foster City, CA • On-site

$190K - $250K/yr

Full-time

Medical, Dental, Vision, Life, Retirement

Posted 6 days ago

Job description

Replit is the agentic software creation platform that enables anyone to build applications using natural language. With millions of users worldwide, Replit is democratizing software development by removing traditional barriers to application creation.
About the Role:
We are seeking a Senior Technical Program Manager to own our vulnerability management program end to end. In this role, you will drive vulnerability intake, triage, remediation, and reporting across our bug bounty program, our Google Cloud Platform (GCP) infrastructure, source code hosted on GitHub, and a broad portfolio of third-party SaaS services. You will partner closely with platform engineering, product engineering, SRE, security, IT, legal, and vendor management to make sure vulnerabilities are found fast, triaged accurately, and closed within SLA - and that leadership always has a clear, current picture of the organization's risk posture.The ideal candidate uses AI and automation aggressively to scale themselves, but understands that the core value is clarity, tradeoffs, and execution, not just tooling.
What you'll do:
  • Program Ownership: Own and continuously improve the vulnerability management program, including intake, severity scoring (CVSS/risk-based), SLA definition, and remediation tracking across all asset types.
  • Bug Bounty Operations: Manage the triage/payouts/rewards workflow, and report on program health and trends.
  • Cloud Remediation (GCP): Drive remediation of vulnerabilities found in GCP infrastructure - IAM, networking, Compute/GKE, storage, and logging/monitoring configuration - by partnering with security, cloud, and platform engineering teams.
  • Code & Supply Chain Security: Coordinate remediation of vulnerabilities surfaced through SAST/DAST/SCA tooling (Wiz Code, Snyk, Dependabot, code scanning, secret scanning) across engineering repos, including dependency and supply-chain risk.
  • SaaS Vendor Risk: Build and manage the process for assessing and tracking security posture across third-party SaaS applications.
  • Escalation & Exceptions: Define and enforce escalation paths for overdue or critical/high-severity findings, including risk acceptance and exception processes with appropriate sign-off.
  • Cross-Team Accountability: Partner with engineering managers and tech leads to embed remediation work into sprint planning and hold teams accountable to remediation SLAs.
  • Reporting & Alerting: Establish and maintain a single source of truth for vulnerability status, aging, SLA compliance, and risk trends, with dashboards for engineering leadership, security leadership, and executives.
  • Audit & Compliance Support: Support audit and compliance efforts (SOC 2, ISO 27001, customer security questionnaires) by keeping vulnerability management evidence and metrics audit-ready.
  • Process & Automation: Drive process improvements and automation to reduce manual triage effort and improve time-to-remediation across all vulnerability sources.

Required Skill & Experience:
  • Experience: 4-6+ years of experience in technical program management, security program management, or security operations, with direct ownership of a vulnerability management or application security program.
  • Bug Bounty Expertise: Hands-on experience running a bug bounty program (e.g., HackerOne, Bugcrowd, Intigriti), including triage and payout workflows.
  • Cloud Security Knowledge (GCP): Working knowledge of GCP security fundamentals: IAM, VPC/networking, Security Command Center, Cloud Logging/Monitoring, and common cloud misconfiguration risks.
  • Code Security Familiarity: Familiarity with GitHub-based development workflows and code security tooling (Wiz Code, Dependabot, SAST/DAST/SCA tools such as Snyk, Semgrep, or CodeQL).
  • Risk Prioritization: Strong grasp of vulnerability scoring frameworks (CVSS) and risk-based prioritization.
  • Communication: Excellent cross-functional communication skills - able to translate technical vulnerability data into business risk for executive audiences and hold engineering teams accountable without owning the code themselves.
  • Reporting Tools: Proven ability to build reporting/dashboards (e.g., Linear, Jira, ServiceNow, Tableau, Looker) that give leadership real-time visibility into program health.
  • Compliance Awareness: Experience supporting compliance frameworks such as SOC 2, ISO 27001, PCI-DSS, or FedRAMP.

What we value:
  • Systems Thinking: The ability to see the "big picture" and understand how vulnerability management decisions impact the entire stack - cloud, code, and vendor ecosystem alike.
  • Technical Influence: The ability to drive alignment across engineering and security through expertise and collaboration rather than direct authority.
  • Autonomy: Comfortable owning a program end to end and driving outcomes with minimal oversight.
  • Bias for Action: A track record of closing the gap between finding a vulnerability and actually getting it fixed.

This is a full-time role that can be held from our Foster City, CA office. The hybrid role has an in-office requirement of Monday, Wednesday, and Friday.
Full-Time Employee Benefits Include:
Competitive Salary & Equity
401(k) Program with a 4% match (US Only)
Health, Dental, Vision and Life Insurance
Short Term and Long Term Disability
Paid Parental, Medical, Caregiver Leave
Flexible Time Off (FTO) + Holidays
Commuter Benefits (In-Office Only)
Monthly Wellness Stipend
Autonomous Work Environment
In Office Set-Up Reimbursement (In-Office Only)
Quarterly Team Gatherings
In Office Amenities (In-Office Only)
Want to learn more about what we are up to?
  • Meet the Replit Agent
  • Replit: Make an app for that
  • Replit Blog
  • Amjad TED Talk

Interviewing + Culture at Replit
  • Operating Principles
  • Reasons not to work at Replit

To achieve our mission of making programming more accessible around the world, we need our team to be representative of the world. We welcome your unique perspective and experiences in shaping this product. We encourage people from all kinds of backgrounds to apply, including and especially candidates from underrepresented and non-traditional backgrounds.

Apply