Bug Bounty Analyst

Job Overview

The Bug Bounty Analyst will be tasked with evaluating reported security vulnerabilities, assigning severity based on CVSS, and effectively communicating findings to both technical and non-technical teams. This role involves strategizing mitigation efforts and coordinating remedial actions in collaboration with whitehat researchers as part of the organisation's Bug Bounty and Vulnerability Disclosure Programs.

Key Responsibilities

• Assess severity levels for identified vulnerabilities according to the Common Vulnerability Scoring System.
• Convey vulnerability insights clearly to stakeholders across varying technical backgrounds.
• Construct and implement mitigation strategies with defined timelines.
• Manage remediation efforts by coordinating with ethical hackers and internal teams.
• Analyze detection gaps by reviewing instances where scanners failed to flag vulnerabilities, then address these issues.
• Identify absent security controls that should have prevented findings and ensure corrective actions are completed.
• Expand program maturity by onboarding additional assets.
• Collaborate with Risk Management to document risks and issues arising from the Bug Bounty Program.
• Maintain awareness of relevant security standards such as PCI, HIPAA, GDPR, PII protection, and NIST Cyber Security Framework.
• Work closely with Legal and Privacy teams when critical data is implicated in findings.
• Follow and update operational runbooks to guide daily activities.

Candidate Qualifications

• Possess a Bachelor's degree in Computer Science, Information Security, or a related discipline, or equivalent relevant professional experience.
• Have no less than two years’ experience in vulnerability management or direct involvement in managing Bug Bounty Programs.
• Demonstrate knowledge of network operations, systems administration across Unix, Linux, MAC, and Windows platforms, security operations including intrusion detection, SIEM, penetration testing, web app assessment, secure coding, and cloud technologies.

Preferred Credentials

• Professional certifications such as CompTIA Security+, CompTIA PenTest, SSCP, CISM, CISA, or CEH.
• Advanced security certifications including CCSLP, GIAC Web Application Defender, eJPT, or OSCP.
• Familiarity with security compliance standards like PCI, GDPR, and NIST CSF.
• Experience using ticketing platforms such as ServiceNow and JIRA.

Desired Skills and Attributes

• Excellent verbal and written communication capabilities.
• Ability to clearly present ideas and influence others to meet strategic objectives.
• Skill in facilitating meetings and driving discussions to resolution with reporting outcomes.
• Proven understanding of vulnerability assessment and exploit methods.
• Competency in applying company policies to solve a range of security challenges.
• Adeptness in working with moderate complexity problems using good judgment.
• Capable of working independently with general guidance on routine tasks.
• Commitment to continuous learning about emerging cyber threats, vulnerabilities, and controls.

Work Environment and Culture

Join a worldwide inclusive team driven by innovation and collaboration. Work alongside industry leaders and enjoy diverse career growth opportunities. We embrace curiosity, ownership, and collective success.

Equal Opportunity Statement

Global Payments Inc. is committed to equal employment opportunity for all applicants and employees.