Intermediate Security Analyst, Vulnerability Operations

🔥 2 minutes ago

🌐 United States, Canada – Remote

🇺🇸 United States – Remote 🇨🇦 Canada – Remote

💵 $115k - $150k / year

⏰ Full Time

🟡 Mid-level

🟠 Senior

🔐 Security Analyst

👻 Ghost score 0%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

GitLab

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

Founded 2014

💼 Consulting

📣 Marketing

🤖 Artificial Intelligence

💰 Secondary Market on 2020-11

Consulting • Marketing • Artificial Intelligence

GitLab is the most comprehensive AI-powered DevSecOps platform, offering tools for automated software delivery, security, and compliance throughout the software development lifecycle. It provides solutions across areas such as AI-assisted development, continuous integration/continuous deployment (CI/CD), source code management, and vulnerability management. GitLab aims to simplify and accelerate software delivery by uniting development, security, and operations on a unified platform. It is particularly recognized for its AI code assistants and has been named a leader in the Gartner Magic Quadrant™ for DevOps Platforms, making it a preferred choice for many enterprises.

📋 Description

• Triage incoming bug bounty reports by reviewing quality, validating findings, assessing impact, identifying duplicates, and routing reports • Triage vulnerabilities from vulnerability management activities and track them through assessment, remediation, and closure • Work with PSIRT engineers and development teams to gather technical details, reproduce issues, and clarify affected products, versions, and configurations • Support severity assessment using CVE, CVSS, CWE, and OWASP frameworks and terminology • Communicate with security researchers involved in coordinated vulnerability disclosure and bug bounty programs • Prepare information for CVE assignment and maintain accurate records as a CVE Numbering Authority • Represent GitLab as an acting CNA representative in CVE-related discussions and operations • Draft and coordinate customer-facing communications about vulnerabilities, fixes, mitigations, and releases • Maintain issue records, timelines, researcher communications, remediation status, and follow-up actions • Monitor queues and operational metrics to identify trends, aging items, recurring issues, and improvement opportunities • Create and improve runbooks, procedures, templates, and documentation • Participate in incident handoffs, root cause analysis documentation, lessons-learned activities, and product security reviews • Build expertise in PSIRT, bug bounty, vulnerability management, and coordinated vulnerability disclosure

🎯 Requirements

• Early-career experience or equivalent education in cybersecurity, software engineering, information technology, or a related field • Foundational understanding of software vulnerabilities and security concepts, including web applications, APIs, CI/CD environments, authentication, and authorization • Familiarity with CVE, CVSS, CWE, OWASP Top 10, and coordinated vulnerability disclosure • Strong attention to detail and ability to organize and prioritize multiple reports or work items • Clear written and verbal communication skills, with ability to explain technical topics to technical and non-technical audiences • Experience with a bug bounty or vulnerability disclosure platform such as HackerOne or Bugcrowd • Experience reviewing security reports, participating in capture-the-flag exercises, performing vulnerability research, or working with security tooling • Familiarity with CVE assignment, CNA processes, security advisories, or vulnerability databases • Basic scripting, log analysis, issue tracking, or data analysis experience is nice to have • Experience writing technical documentation, customer communications, support responses, or operational procedures is nice to have

🏖️ Benefits

• Benefits to support your health, finances, and well-being • Flexible Paid Time Off • Team Member Resource Groups • Equity Compensation & Employee Stock Purchase Plan • Growth and Development Fund • Parental Leave