Bugcrowd, founded in 2012, is a global leader in crowdsourced security testing and vulnerability management. Headquartered in San Francisco and New Hampshire, the company combines AI‑driven intelligence with a worldwide community of ethical hackers to help enterprises discover, prioritize, and remediate real‑world security risks. Backed by prominent venture capital firms such as General Catalyst, Rally Ventures, and Costanoa Ventures, Bugcrowd has grown rapidly and now serves some of the world’s largest brands across multiple industries, including automotive, IoT, mobile, and embedded systems. The company’s culture emphasizes collaboration, continuous learning, and a strong commitment to diversity and inclusion, making it an attractive workplace for security enthusiasts. As an Application Security Engineer (ASE) at Bugcrowd, you will be at the heart of the company’s bug bounty and vulnerability assessment operations. You will triage, validate, and prioritize incoming security reports from researchers, ensuring that each finding is accurately classified and communicated to the relevant client teams. The role offers exposure to a wide variety of application types—from web and mobile apps to embedded devices—allowing you to deepen expertise in complex vulnerability classes such as XSS, SQLi, XXE, IDOR, SSTI, and SSRF. You will also collaborate closely with the Director of Technical Operations to design and improve internal tooling, automate repetitive triage tasks, and contribute to incident response for high‑severity bugs. Key Responsibilities: 1. Perform detailed triage of vulnerability submissions, validating reproducibility, impact, and severity. 2. Communicate with researchers and clients to gather additional information and clarify findings. 3. Escalate critical vulnerabilities to clients and coordinate incident‑response activities. 4. Maintain and enhance internal triage and validation tooling using scripting languages (e.g., Python, Bash). 5. Conduct independent security assessments on diverse platforms, including web, mobile, IoT, and embedded systems. 6. Produce clear, concise remediation guidance and documentation for clients. 7. Stay up‑to‑date with the latest OWASP Top Ten threats and emerging attack techniques. 8. Contribute to knowledge‑sharing sessions, internal blogs, and community outreach initiatives. 9. Assist in onboarding new researchers and clients to Bugcrowd’s platform. 10. Participate in continuous improvement initiatives to streamline workflow and reduce false‑positive rates. Tech Stack & Tools: OWASP Top Ten, Burp Suite, OWASP ZAP, Nmap, sqlmap, Kali Linux utilities, Python/Bash scripting, Git, CI/CD pipelines, cloud platforms (AWS/GCP), and basic familiarity with containerization (Docker). Growth Path: Starting as an ASE, you can progress to Senior Application Security Engineer, then to Technical Lead or Manager of Technical Operations. Bugcrowd also offers pathways into specialized roles such as Threat Intelligence Analyst, Security Researcher, or Product Security Engineer, depending on your interests and performance. Why Join Bugcrowd? You will work with the world’s most skilled security researchers, gain hands‑on experience across a broad spectrum of technologies, and be part of a fast‑growing startup recognized as one of the “10 Coolest Security Startups of 2016.” The remote‑first model provides flexibility, while the inclusive culture ensures you can bring your whole self to work and grow both technically and professionally.