Bug Bounty Analyst

Role Overview

As a Bug Bounty Analyst, you will evaluate and categorize security vulnerabilities reported through our Bug Bounty and Vulnerability Disclosure Programs, ensuring they are handled appropriately according to established scoring systems and security standards.

Key Responsibilities

• Assess reported bugs and assign severity ratings using the Common Vulnerability Scoring System (CVSS).
• Clearly communicate vulnerability details to both technical teams and non-technical stakeholders.
• Develop and oversee strategies for vulnerability mitigation including defining plans and schedules.
• Coordinate remediation efforts directly with whitehat researchers involved in the Bug Bounty program.
• Analyze security findings to identify weaknesses in vulnerability scanner coverage and collaborate to enhance detection capabilities.
• Detect and track the correction of missing security controls that could have mitigated identified vulnerabilities.
• Expand and improve the Bug Bounty program, including integrating new assets.
• Work closely with Risk Management to document risks emerging from Bug Bounty discoveries.
• Maintain expertise in relevant security frameworks and regulations such as PCI, HIPAA, GDPR, PII, and NIST Cyber Security Framework.
• Partner with Legal and Privacy teams when findings indicate critical data exposure risks.
• Follow established runbooks to manage day-to-day operations effectively.

Required Qualifications & Experience

• Bachelor's degree in Computer Science, Information Security, or a related discipline, or equivalent relevant work experience.
• At least 2 years of hands-on experience with vulnerability management or Bug Bounty program operations.
• Familiarity with network operations, engineering, or system administration across Unix, Linux, Mac, or Windows platforms.
• Knowledge of security operations including intrusion detection, SIEM tools, penetration testing, web application assessments, secure coding, and cloud technologies.

Preferred Certifications and Knowledge

• Professional certifications such as CompTIA Security+, CompTIA PenTest, SSCP, CISM, CISA, CEH.
• Additional certifications like CCSLP, GIAC Web Application Defender, eJPT, or OSCP.
• Insight into industry-standard compliance programs including PCI DSS, GDPR, and NIST CSF.
• Experience with ticketing tools such as ServiceNow and JIRA.

Desired Skills and Attributes

• Exceptional verbal and written communication abilities.
• Strong attention to detail and active listening skills.
• Ability to comfortably communicate and influence to achieve objectives.
• Skilled at facilitating meetings and managing discussions to drive issue resolution.
• Proven knowledge and experience in vulnerability management, understanding exploit techniques.
• Ability to develop professional expertise and adept at applying company policies to resolve diverse issues.
• Capable of independent work on moderately complex challenges using sound judgment.
• Commitment to continuous learning of emerging threats, vulnerabilities, and mitigation technologies.

About the Team

Join a diverse global team where collaboration and innovation are valued. You will be surrounded by industry experts and dynamic opportunities for career growth, integrated within a culture that supports ownership, curiosity, and teamwork.

Equal Opportunity Statement

Global Payments Inc. is dedicated to providing equal employment opportunities for all applicants.