ZipRecruiter

Log In

1

Highest Bug Bounty Income Jobs (NOW HIRING)

Mercor

Security Engineer, Application Security

New York, NY · On-site

$130K - $500K/yr

You'll own application security at a company where the app layer is the highest-priority security ... Bug bounty program operations - triaging HackerOne reports, validating findings, and driving fixes ...

Tines

Senior Product Security Engineer

$117K - $160K/yr

This flexibility enables our customers to achieve their highest-priority goals faster. And because ... Contribute to our vulnerability management program, including triaging bug bounty and vulnerability ...

Mercor

Security Engineer, Application Security

New York, NY · On-site

$130K - $400K/yr

You'll own application security at a company where the app layer is the highest-priority security ... Bug bounty program operations - triaging HackerOne reports, validating findings, and driving fixes ...

Qualia

Senior Application Security Engineer

Austin, TX · Remote

$180K - $210K/yr

Lead threat modeling and secure design review for the highest-risk initiatives across the company ... Background meaningfully contributing to a bug bounty program * Experience with identity and access ...

Consensys

Senior Application Security Engineer

OR · Remote

$114K - $156K/yr

It is of highest importance to us that we keep our users as safe and secure as possible. We are ... Determine the root cause and severity of vulnerabilities reported to us through our bug bounty ...

Salesforce, Inc.

Product Security

Bellevue, WA · On-site

$66.25 - $88.50/hr

... highest security standards. Responsibilities: * Embed security controls throughout the entire ... Active participation in bug bounty programs (HackerOne, Bugcrowd) or contributions to open-source ...

Assured

Staff Security Engineer

Palo Alto, CA · Remote

... bug bounty program, including triage, response processes, and improvements to vulnerability ... Assured contributes 3% of your income, even if you don\'t contribute 🏠 WFH Benefits: Lunch on us ...

Salesforce, Inc.

Product Security

San Francisco, CA · On-site

$69.25 - $92.50/hr

... highest security standards. Responsibilities: * Embed security controls throughout the entire ... Active participation in bug bounty programs (HackerOne, Bugcrowd) or contributions to open-source ...

Chime Financial, Inc

Senior Security Engineer

New York, NY · On-site

$125K - $171K/yr

Pen testing or bug bounty experience * Familiarity with GRC tools and frameworks #LI-Hybrid #LI-JL1 ... highest bars for our teams, our company, and our members. We believe in being bold, dreaming big ...

Consensys

Senior Application Security Engineer

It is of highest importance to us that we keep our users as safe and secure as possible. We are ... Determine the root cause and severity of vulnerabilities reported to us through our bug bounty ...

Salesforce, Inc.

Product Security

San Francisco, CA · On-site

$69.25 - $92.50/hr

... highest security standards. Responsibilities: * Embed security controls throughout the entire ... Active participation in bug bounty programs (HackerOne, Bugcrowd) or contributions to open-source ...

next page

Showing results 1-20

All JobsHighest Bug Bounty Income Jobs

Highest Bug Bounty Income information

See salary details

$35K

$77.9K

$126.5K

How much do highest bug bounty income jobs pay per year?

As of Jun 19, 2026, the average yearly pay for highest bug bounty income in the United States is $77,893.00, according to ZipRecruiter salary data. Most workers in this role earn between $56,500.00 and $78,500.00 per year, depending on experience, location, and employer.
What cities are hiring for Highest Bug Bounty Income jobs? Cities with the most Highest Bug Bounty Income job openings:
What states have the most Highest Bug Bounty Income jobs? States with the most job openings for Highest Bug Bounty Income jobs include:
Highest Bug Bounty Income jobs near you

Security Engineer, Application Security

Mercor

New York, NY • On-site

$130K - $500K/yr

Full-time

Medical, Dental, Vision

This job post has expired today. Applications are no longer accepted.

Job description

About Mercor
Mercor's mission is to organize human intelligence to power the AI economy. We partner with leading AI labs and enterprises to provide the human intelligence essential to AI development. Our vast talent network trains frontier AI models in the same way teachers teach students: by sharing knowledge, experience, and context that can't be captured in code alone. Today, more than 30,000 experts in our network collectively earn over $3 million a day.
Mercor is creating a new category of work where expertise powers AI advancement. Achieving this requires an ambitious, fast-paced and deeply committed team. You'll work alongside researchers, operators, and AI companies at the forefront of shaping the systems that are redefining society. Mercor is a profitable Series C company valued at $10 billion. We work in-person five days a week in our San Francisco, NYC, or London offices.
You'll own application security at a company where the app layer is the highest-priority security surface. This is not a scan-and-triage role. You'll embed in the development lifecycle, review code for exploitable flaws, build security tooling into CI/CD, and drive vulnerability remediation across a platform serving 300K+ experts and enterprise clients processing sensitive AI training data.
We use AI heavily in our own security work. You should be comfortable building alongside AI code-gen tools, using LLMs to accelerate code review and threat modeling, and automating away the repetitive work that slows AppSec programs down. If you'd rather write a CodeQL query than file a Jira ticket, you'll fit in here.
We're in-person five days a week at our SF headquarters, with first Fridays remote.
What You'll Build:
  • Security review workflows embedded in the SDLC - PR-level analysis that catches auth bugs, injection flaws, and business logic errors before they ship
  • SAST/DAST pipelines integrated into CI/CD - shifting security left without slowing down deploys
  • Vulnerability management processes that prioritize by real exploitability, not CVSS score
  • Secure coding standards and guardrails that make the safe path the easy path for 50+ engineers
  • Threat models for new features and architecture changes - especially around AI data pipelines, payment flows, and multi-tenant boundaries
  • Bug bounty program operations - triaging HackerOne reports, validating findings, and driving fixes to closure
What We're Looking For
  • You've found and fixed real vulnerabilities in production applications - not just run scanners
  • Deep understanding of web application security: OWASP Top 10 is baseline, you think in terms of attack chains and business logic flaws
  • Strong in at least one of Python, TypeScript, or Go - you can read a PR and spot the auth bypass
  • Experience building or tuning SAST/DAST tooling (Semgrep, CodeQL, Snyk, Burp, or similar)
  • You understand modern web frameworks, APIs, and authentication patterns well enough to threat model them
  • Experience managing a vulnerability pipeline - from discovery through prioritization to verified remediation
  • 5+ years of professional experience in application security, security engineering, or software engineering with a strong security focus
Bonus Points
  • Experience running or triaging a bug bounty program (HackerOne, Bugcrowd)
  • Offensive security skills - you've done penetration testing and can think like an attacker
  • Experience securing AI/ML applications - model serving APIs, training data pipelines, prompt injection defense
  • Familiarity with supply chain security - dependency scanning, registry firewalls (Socket, Snyk)
  • You've built custom security tooling that a team still uses
  • Contributions to open source security projects or published vulnerability research
Why Mercor
  • The problem is real. Application security at scale is hard - you'll build defenses that matter across a fast-moving platform.
  • AI-native AppSec. You'll use frontier AI tools daily - for code review, vulnerability analysis, and anything that benefits from an AI co-pilot.
  • Ownership from day one. You'll own the entire application security domain - from code review processes to CI/CD security to bug bounty operations.
  • See the future early. Working alongside AI labs means you'll understand frontier model capabilities months before the market.
Benefits
  • Bi-annual performance bonus structure
  • Generous equity grant vested over 4 years
  • Up to $15k Relocation bonus
  • $10K housing bonus (if you live within 0.5 miles of our office)
  • $1.5K monthly stipend for meals
  • Free Equinox membership
  • $200 monthly laundry reimbursement
  • $200 monthly personal wellness reimbursement
  • Health, Dental, Vision insurance

Apply