Remote opportunity at
HackerOneProduct Security Analyst
HackerOne, a global leader in continuous threat exposure management and offensive security solutions, is seeking a remote Product Security Analyst to join its Technical Services organization.…
Career Tools
About This Role
HackerOne, a global leader in continuous threat exposure management and offensive security solutions, is seeking a remote Product Security Analyst to join its Technical Services organization. In this position, you will examine vulnerability reports submitted by security researchers, independently replicate issues across mobile and web applications, and collaborate with globally distributed teams to help enterprise customers manage cyber risks. This role is suited for security professionals with a background in…
Job Description
HackerOne, a global leader in continuous threat exposure management and offensive security solutions, is seeking a remote Product Security Analyst to join its Technical Services organization. In this position, you will examine vulnerability reports submitted by security researchers, independently replicate issues across mobile and web applications, and collaborate with globally distributed teams to help enterprise customers manage cyber risks. This role is suited for security professionals with a background in ethical hacking or vulnerability research who want to deepen their technical expertise while working closely with the broader hacker community and leveraging AI-powered platforms.
HackerOne operates on a flexible work model while maintaining targeted geographical proximity requirements. Candidates for this remote position must live within approximately fifty miles of Boston, Massachusetts; Austin, Texas; Washington, D.C.; Seattle, Washington; or the San Francisco Bay Area in California. The role requires handling occasional weekend shifts and offers an annual salary ranging between USD 135,000 and 155,000.
As an equal opportunity employer, HackerOne provides a comprehensive package of perks and health coverage. Employment is contingent on successfully passing a background check, and visa or work permit sponsorship is not available for this opening.
Responsibilities
- Assess vulnerability reports from security researchers to evaluate validity, severity, exploitability, and business impact using frameworks like CVSS
- Independently reproduce reported vulnerabilities across web and mobile software to verify findings and uncover root causes
- Communicate directly with security researchers to gather missing information and improve report clarity
- Produce clear, technically accurate summaries containing reproduction steps, impact assessments, and remediation advice for validated discoveries
- Adapt to changing program scopes, emerging attack techniques, and shifting operational priorities
- Utilize automation and AI-enabled workflows to support operational efficiency and triage quality
- Coordinate cross-functionally with technical services and customer-facing teams to ensure timely vulnerability handling
- Proactively recommend improvements for internal workflows, tooling, documentation, and triage processes
- Perform occasional weekend shifts as required by the operation
Requirements
- Minimum of 3 years of hands-on background in security testing, ethical hacking, or vulnerability research focused on mobile and web applications
- Solid technical grasp of prevalent application security flaws, including the OWASP Top 10
- Working knowledge of testing instruments such as Burp Suite and vulnerability scoring systems such as CVSS
- Fluent written and spoken English proficiency with the ability to convey technical subjects clearly to various audiences
- Ability and willingness to work weekend shifts periodically
- Proximity within approximately 50 miles of Boston, MA, Austin, TX, Washington, DC, Seattle, WA, or the San Francisco Bay Area, CA
Qualifications
- Prior participation in bug bounty or vulnerability disclosure programs
- Experience validating and reproducing vulnerabilities reported by customers or external researchers
- Familiarity with automation or scripting applied to operational workflows or security testing
- Demonstrated capability to balance competing priorities within a fast-paced and globally distributed setting
Core Skills
Benefits
- Medical, dental, and vision health insurance
- Life and disability insurance
- Equity stock options
- Retirement plans
- Paid public holidays and unlimited paid time off
- Paid maternity and parental leave
- Leaves of absence including caregiver leave and leave under CO's Healthy Families and Workplaces Act
- Employee Assistance Program
Frequently Asked Questions
What is the location and remote work policy for this role?
This is a remote position, but candidates must reside within approximately 50 miles of Boston, MA, Austin, TX, Washington, DC, Seattle, WA, or the San Francisco Bay Area, CA.
What is the salary for the Product Security Analyst position?
The salary ranges from USD 135,000 to 155,000 per year for Tier A locations like the SF Bay Area, and from USD 120,000 to 140,000 for other eligible locations, alongside equity stock options.
What are the core experience requirements?
Applicants must have at least 3 years of hands-on experience in ethical hacking, vulnerability research, or security testing on web and mobile platforms, along with familiarity with the OWASP Top 10 and CVSS.
Does HackerOne provide visa sponsorship for this job?
No, visa or work permit sponsorship is not available for this role.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.
