Product Security Engineer Job at Replit (Foster City)

Product Security Engineer

Replit

Location:
United States , Foster City

Category:
IT - Software Development

Contract Type:
Not provided

Salary:

180000.00 - 325000.00 USD / Year

Save Job

Apply Position

Job Description:

We are looking for a highly skilled PSIRT Engineer to lead the vulnerability response program for Replit’s cloud-native AI platform. You will own the lifecycle of security vulnerabilities affecting our products and services—from intake to validation, remediation coordination, and public disclosure. This role requires strong technical ability to reproduce vulnerabilities, deep understanding of web/app/cloud exploit classes, and experience operating bug bounty and coordinated disclosure programs. You will work closely with Engineering, Cloud Security, SecOps, SRE, and IT teams to ensure vulnerabilities are fixed quickly and communicated responsibly.

Job Responsibility:

Manage intake from bug bounty platforms (HackerOne preferred), customer reports, automated scanners, pentest reports, and coordinated disclosure channels
Independently validate, reproduce, severity-score, and document findings
Identify duplicates and maintain a clean vulnerability records pipeline
Assess relevance and exploitability using OWASP, cloud misconfiguration patterns, and identity/authentication/authorization risks (Oauth, OIDC)
Work with Engineering, SecOps, IT, SRE, and Cloud Security to confirm product impact and drive remediation
Provide detailed reproduction steps, proof-of-concepts, and technical analyses
Track SLAs, remediation progress, regression testing, and systemic improvements
Support SOC 2, ISO 27001, and pentest evidence needs as part of vulnerability lifecycle governance
Design and evolve the bug bounty program, including scope, rules, and reward structures
Manage platform selection, private vs. public launches, and community engagement
Communicate clearly with researchers, provide clarifications, and handle feedback or disputes
Determine reward payouts, bonus decisions, and recognition for top contributors
Lead the coordinated vulnerability disclosure process for internal and external findings
Negotiate disclosure timelines with researchers and partners
Coordinate CVE assignments and publications, and prepare customer/public advisories

Requirements:

Experience running or triaging for bug bounty programs (HackerOne ideally)
Strong ability to triage, validate, and reproduce vulnerabilities independently
Deep understanding of web/app/cloud vulnerability classes, OWASP Top 10, misconfigurations, authN/Z issues, etc.
Familiarity with cloud platforms (GCP preferred) and SaaS architectures
Strong understanding of CI/CD workflows, code structure, and software engineering fundamentals

Nice to have:

Scripting or automation experience (Python, Go, Bash)
Pentesting background or exposure to offensive security work
Familiarity with compliance frameworks such as SOC 2 and ISO 27001
Experience authoring public advisories or CVE writeups
Hands-on experience with SIEM, Cloud Logging, and investigative tooling

What we offer:

Competitive Salary & Equity
401(k) Program with a 4% match
Health, Dental, Vision and Life Insurance
Short Term and Long Term Disability
Paid Parental, Medical, Caregiver Leave
Commuter Benefits
Monthly Wellness Stipend
Autonomous Work Environment
In Office Set-Up Reimbursement
Flexible Time Off (FTO) + Holidays
Quarterly Team Gatherings
In Office Amenities

Additional Information:

Job Posted:
February 18, 2026

Employment Type:

Fulltime

Work Type:

On-site work

Replit - All Job Offers

Job Link Share: