Replit
Product Security Engineer (PSIRT - Product Security Incident Response Team)
Foster City, CA · Full-time
Sponsorship not specifiedDetected 93 days ago
PythonGoBashGCPCloud PlatformsCI/CDSite Reliability EngineeringOAuthCybersecurityPenetration TestingSIEMIncident ResponseComplianceManual Testing
About the role
- You will work closely with Engineering, Cloud Security, SecOps, SRE, and IT teams to ensure vulnerabilities are fixed quickly and communicated responsibly.
Responsibilities
- Independently validate, reproduce, severity-score, and document findings.
- Identify duplicates and maintain a clean vulnerability records pipeline.
- Work with Engineering, SecOps, IT, SRE, and Cloud Security to confirm product impact and drive remediation.
- Design and evolve the bug bounty program, including scope, rules, and reward structures.
- Manage platform selection, private vs. public launches, and community engagement.
- Lead the coordinated vulnerability disclosure process for internal and external findings.
- Negotiate disclosure timelines with researchers and partners.
Requirements
- This role requires strong technical ability to reproduce vulnerabilities, deep understanding of web/app/cloud exploit classes, and experience operating bug bounty and coordinated disclosure programs.
Nice to have
- Scripting or automation experience (Python, Go, Bash).
- Pentesting background or exposure to offensive security work.
- Familiarity with compliance frameworks such as SOC 2 and ISO 27001.
- Experience authoring public advisories or CVE writeups.
- Hands-on experience with SIEM, Cloud Logging, and investigative tooling.
- This is a full-time role that can be held from our Foster City, CA office.
- The role has an in-office requirement of Monday, Wednesday, and Friday.
- 💹 401(k) Program with a 4% match (US Only)
Skills
- Experience running or triaging for bug bounty programs (HackerOne ideally).
- Deep understanding of web/app/cloud vulnerability classes, OWASP Top 10, misconfigurations, authN/Z issues, etc.
- Familiarity with cloud platforms (GCP preferred) and SaaS architectures.
- Strong understanding of CI/CD workflows, code structure, and software engineering fundamentals.
Compensation
- 💰 Competitive Salary & Equity
Benefits
- Determine reward payouts, bonus decisions, and recognition for top contributors.
Company info
- Replit Blog https://blog.replit.com/
- Amjad TED Talk https://youtu.be/kCudFI4tcpg?si=l4ViCejV_f2RZkDi
- Operating Principles https://blog.replit.com/operating-principles
- Reasons not to work at Replit https://blog.replit.com/reasons-not-to-join-replit
- Support SOC 2, ISO 27001, and pentest evidence needs as part of vulnerability lifecycle governance.
This listing is sourced directly from Replit's careers page and normalized into a canonical job model.