Specialty
The role
GitLab is hiring an Intermediate Security Analyst for its Product Security Vulnerability Operations team, which handles bug bounty reports and vulnerability disclosure. The role is open across North America, with a preference for the Pacific Time Zone.
What you will do
- Triage bug bounty reports: validate findings, assess impact, find duplicates and route them to teams
- Triage vulnerabilities from vulnerability management and track them through remediation
- Work with PSIRT engineers and developers to reproduce issues and identify affected versions
- Assess severity using CVE, CVSS, CWE and OWASP, and prepare information for CVE assignment as a CNA
- Draft customer-facing communications about vulnerabilities and fixes with Legal, Support and Communications
- Maintain records and improve runbooks, templates and documentation
What they ask for
- Early-career experience or education in cybersecurity, software engineering or IT; internships and projects count
- Foundational knowledge of software vulnerabilities, web applications, APIs, CI/CD, authentication and authorization
- Familiarity with CVE, CVSS, CWE, OWASP Top 10 and coordinated vulnerability disclosure
- Strong attention to detail and ability to prioritize multiple reports
- Clear written and verbal communication with technical and non-technical audiences
- Located in North America; West Coast US or British Columbia preferred
This is our own short reading of the posting. The full description, and anything that has changed since, is on GitLab's careers page behind the apply button.
