ZipRecruiter

Log In

1

Bug Bounty Program Jobs (NOW HIRING)

Merge

Security Engineer

Manhattan, NY · On-site

... our bug bounty program end to end: triage, response, remediation, and researcher communication • Partner with Engineering to embed secure design patterns and security review into how we ship ...

Accenture Federal Services

CNO Developer

Chantilly, VA · On-site

$129K - $177K/yr

Desire to contribute to CTF events, bug bounty programs, and speaking at the security conferences * Rapid Prototype Software Development Security Clearance: * Active TS/SCI level clearance. Must be ...

Outreach

Technical Program Manager - Security

Seattle, WA · Remote

$130K - $170K/yr

Experience managing cross-functional, large-scale technical security programs, including the Security Vulnerability Program, Security Exceptions Program, and Bug Bounty Program * Familiar with ...

Accenture Federal Services

CNO Developer

Chantilly, VA · On-site

$130K - $178K/yr

... events, bug bounty programs, and speaking at the security conferences • Rapid Prototype Software Development Company : Accenture Federal Services is a leading US federal services company and ...

Outreach

Technical Program Manager - Security

Seattle, WA · On-site +1

$130K - $170K/yr

Experience managing cross-functional, large-scale technical security programs, including the Security Vulnerability Program, Security Exceptions Program, and Bug Bounty Program * Familiar with ...

Outreach

Technical Program Manager - Security

Seattle, WA · Remote

$130K - $170K/yr

Experience managing cross-functional, large-scale technical security programs, including the Security Vulnerability Program, Security Exceptions Program, and Bug Bounty Program * Familiar with ...

Accenture Federal Services

CNO Developer

Chantilly, VA · On-site

$130K - $178K/yr

... events, bug bounty programs, and speaking at the security conferences • Rapid Prototype Software Development Company : Accenture Federal Services is a leading US federal services company and ...

Alignerr

Application Security Analyst

Miami, FL · On-site

Background in bug bounty programs or red teaming * Familiarity with AI or machine learning evaluation workflows Why Join Us * Work directly on cutting-edge AI projects with top research labs * Fully ...

Merge LLC

Head of Security

San Francisco, CA · On-site

$240K - $280K/yr

Manage our Bug Bounty Program * Implement security controls across Merge, from infrastructure to CI * Implement and run manual and automated security practices to mitigate vulnerabilities * Assist ...

Etherfi

Security Engineer

New York, NY · On-site

... Bug Bounty & Vulnerability Management Be the primary owner of our ImmuneFi program - triaging, reproducing, and responding to incoming submissions daily Prioritize and track vulnerabilities through ...

Futran Tech Solutions Pvt. Ltd.

AppSec SME

$60.25 - $80.25/hr

Monitor and track the Bug bounty vulnerabilities and remediation closure * Track the coverage of ... Manage the program and communicate with client team * Identify, manage risks and provide risks ...

Alignerr

Application Security Analyst

Experience in penetration testing, secure code review, or bug bounty programs * Familiarity with threat modeling frameworks or security design patterns * Background in cloud-native, API-first, or ...

next page

Showing results 1-20

All JobsBug Bounty Program Jobs

Bug Bounty Program information

See salary details

$16

$49

$78

How much do bug bounty program jobs pay per hour?

As of Jun 26, 2026, the average hourly pay for bug bounty program in the United States is $49.60, according to ZipRecruiter salary data. Most workers in this role earn between $31.73 and $66.83 per hour, depending on experience, location, and employer.

How do I join a bug bounty program?

To join a bug bounty program, you typically need to register on the platform hosting the program, such as HackerOne or Bugcrowd, and agree to their rules and scope. Developing skills in web security, using tools like Burp Suite or OWASP ZAP, and understanding responsible disclosure are essential. Some programs may require prior experience or certifications like OSCP or CEH.

What are some common challenges faced by professionals managing a Bug Bounty Program?

Professionals overseeing a Bug Bounty Program often encounter challenges such as efficiently triaging a high volume of vulnerability reports, ensuring clear communication with security researchers, and balancing quick response times with thorough investigation. Additionally, maintaining strong relationships with both internal development teams and external participants is crucial for program success. Staying updated on evolving security threats and continually refining program policies are ongoing responsibilities that require adaptability and collaboration.

How much do bug bounties get paid?

Bug bounty programs pay security researchers based on the severity and impact of the vulnerabilities they discover, with rewards ranging from $100 to over $100,000 for critical issues. Payments vary depending on the program, the organization, and the complexity of the bug, and researchers often use platforms like HackerOne or Bugcrowd to participate.

Which bug bounty pays the most?

Bug bounty programs from large technology companies like Apple, Google, and Microsoft tend to offer the highest payouts, often reaching hundreds of thousands of dollars for critical vulnerabilities. Successful bug bounty hunters typically have strong technical skills, knowledge of security testing tools, and experience in identifying high-impact security flaws.

What are the key skills and qualifications needed to thrive as a Bug Bounty Program participant, and why are they important?

To excel in a Bug Bounty Program, you need strong knowledge of cybersecurity fundamentals, vulnerability assessment, and web or software exploitation techniques, often backed by practical experience or certifications like OSCP or CEH. Familiarity with tools such as Burp Suite, Nmap, and Metasploit, as well as bug bounty platforms like HackerOne or Bugcrowd, is typically required. Critical thinking, persistence, and clear written communication are crucial soft skills for effectively identifying vulnerabilities and reporting them to organizations. These skills ensure you can discover security flaws efficiently, responsibly disclose them, and build a positive reputation in the cybersecurity community.

What is a Bug Bounty Program?

A Bug Bounty Program is an initiative offered by organizations that invites ethical hackers and security researchers to identify and report vulnerabilities in the company’s software, websites, or systems. Participants are typically rewarded with monetary compensation, recognition, or other incentives based on the severity of the bugs they find. These programs help organizations strengthen their security by leveraging the broader cybersecurity community, thus identifying issues before malicious hackers can exploit them. Bug bounty programs are widely used by tech companies to enhance security and build trust with users.

Will Facebook pay $500 if you find a bug in their code?

As a bug bounty program participant, Facebook's bug bounty rewards vary depending on the severity and impact of the vulnerability found. While some reports have received payments of $500 or more, the amount is not guaranteed and depends on the quality and significance of the bug. Participants should review Facebook's bug bounty guidelines for specific payout details and submission criteria.

What is the difference between Bug Bounty Program vs Penetration Tester?

AspectBug Bounty ProgramPenetration Tester
CredentialsKnowledge of security vulnerabilities, bug reporting skillsCertifications like OSCP, CEH, CISSP often preferred
Work EnvironmentRemote, project-based, crowdsourcedConsulting firms, in-house teams, on-site or remote
Industry UsageTech companies, startups, open security initiativesSecurity firms, corporate security teams, government agencies
Search/Comparison IntentUnderstanding crowdsourced bug finding vs professional testingComparing freelance or company-based security assessments

The main difference is that Bug Bounty Programs are crowdsourced initiatives where individuals report vulnerabilities remotely, often without formal certifications. Penetration Testers are professionals with certifications who perform targeted security assessments, usually in a consulting or in-house setting. Both roles focus on identifying security flaws but differ in structure, credentials, and work environment.

More about Bug Bounty Program jobs
What cities are hiring for Bug Bounty Program jobs? Cities with the most Bug Bounty Program job openings:
What are the most commonly searched types of Bug Bounty Program jobs? The most popular types of Bug Bounty Program jobs are:
What states have the most Bug Bounty Program jobs? States with the most job openings for Bug Bounty Program jobs include:
What job categories do people searching Bug Bounty Program jobs look for? The top searched job categories for Bug Bounty Program jobs are:
Bug Bounty Program jobs near you
Infographic showing various Bug Bounty Program job openings in the United States as of June 2026, with employment types broken down into 50% Full Time, and 50% Contract. Highlights an 100% In-person job distribution, with an average salary of $103,178 per year, or $49.6 per hour.
Security Engineer

Security Engineer

Merge

Manhattan, NY • On-site

Full-time

Posted 8 days ago

Job description

Job Summary:
Merge is the leading provider of agentic tools and customer-facing integrations for frontier LLMs, Fortune 500 organizations, and B2B SaaS companies. As a Security Engineer at Merge, you will be the primary owner of product and application security across the platform, working closely with Engineering and Product to identify and fix vulnerabilities while ensuring strong security guarantees for API-first, AI-powered products.
Responsibilities:
• Own product and application security across Merge's platform: APIs, integrations, agent tooling, and AI-powered features
• Conduct security reviews, threat modeling, and code reviews with a focus on application-layer vulnerabilities (OWASP Top 10, injection, auth flaws, insecure deserialization, etc.)
• Drive vulnerability identification and remediation across the full SDLC, from design through deployment
• Build and mature our application security program, including SAST/DAST tooling, security testing in CI/CD, and developer security guidance
• Utilize AI to test the resiliency of our applications and systems
• Own and operate our bug bounty program end to end: triage, response, remediation, and researcher communication
• Partner with Engineering to embed secure design patterns and security review into how we ship software
• Support infrastructure and cloud security as needed, with a focus on how it intersects with our product surface
Qualifications:
Required:
• 3–6+ years of security engineering experience with a strong focus on product or application security
• Deep familiarity with application security concepts: OWASP, common vulnerability classes, secure API design, auth and authorization patterns
• Experience conducting threat modeling and secure code reviews
• Hands-on experience with application security tooling (SAST, DAST, SCA) and integrating security into CI/CD pipelines
• Experience with and a desire to code in at least one major programming language. You should be comfortable reading and writing code, not just running scanners
• Experience in a SaaS or API-driven environment; familiarity with multi-tenant systems and the security challenges they present
• Interest in learning and supporting other areas of Security where needed
Preferred:
• Experience with AI/LLM security, agent security, or securing data-heavy API platforms
Company:
Merge is one API to add hundreds of integrations to your product Founded in 2020, the company is headquartered in San Francisco, USA, with a team of 51-200 employees. The company is currently Growth Stage.

Apply