Intermediate Security Analyst, Vulnerability Operations (North America)

Remote · USD 115,000-150,000 · Remote · Posted Sep 24, 2026

At a glance

The Security Analyst on the Product Security Vulnerability Operations team protects customers by triaging security reports and supporting vulnerability management operations.
This role involves coordinating communications with security researchers, customers, and internal teams while building expertise in product security response.
The position is designed for an early-career security professional who is organized, detail-oriented, and capable of managing vulnerability lifecycles.

Triage incoming bug bounty reports by validating findings, assessing impact, and routing to appropriate teams.
Triage vulnerabilities identified through management activities and track them through remediation.
Collaborate with PSIRT and development teams to reproduce issues and clarify technical details.
Support severity assessment using frameworks like CVE, CVSS, CWE, and OWASP.
Communicate professionally with security researchers in bug bounty programs.
Support GitLab's role as a CVE Numbering Authority by maintaining records and coordinating activities.
Draft customer-facing communications regarding security vulnerabilities and fixes.
Maintain accurate issue records, timelines, and researcher communications.
Monitor operational metrics to identify trends and improve response quality.
Create and improve runbooks, procedures, and documentation for vulnerability handling.

Early-career experience or equivalent education in cybersecurity, software engineering, or IT.
Foundational understanding of software vulnerabilities, web applications, APIs, CI/CD, authentication, and authorization.
Familiarity with security terminology including CVE, CVSS, CWE, and OWASP Top 10.
Strong attention to detail and ability to organize multiple work items.
Clear written and verbal communication skills for technical and non-technical audiences.
Experience with a bug bounty or vulnerability disclosure platform like HackerOne or Bugcrowd.
Experience reviewing security reports, participating in CTFs, or performing vulnerability research.
Familiarity with CVE assignment, CNA processes, or security advisories.

Remote role open to candidates across North America.
Preference for candidates based on the West Coast US or West Coast Canada (British Columbia) for Pacific Time Zone coverage.