Intermediate Security Analyst, Vulnerability Operations (North America)

Responsibilities

• Triage incoming bug bounty reports, including reviewing report quality, validating findings, assessing potential impact, identifying duplicates, and routing reports to the appropriate teams.
• Triage vulnerabilities identified through vulnerability management activities and help track them through assessment, remediation, and closure.
• Work with PSIRT engineers and development teams to gather technical details, reproduce issues, and clarify affected products, versions, and configurations.
• Support severity assessment using frameworks and terminology such as CVE, CVSS, CWE, and OWASP.
• Communicate professionally and respectfully with security researchers participating in coordinated vulnerability disclosure and bug bounty programs.
• Support GitLab’s role as a CVE Numbering Authority by preparing information for CVE assignment, maintaining accurate records, and helping coordinate CVE-related activities.
• Represent GitLab as an acting CNA representative in CVE-related discussions and operations, escalating questions and coordinating with the appropriate internal and external stakeholders.
• Draft and coordinate customer-facing communications about security vulnerabilities, fixes, mitigations, and release information in partnership with PSIRT, Legal, Customer Success
• Support, and Corporate Communications.
• Maintain accurate issue records, timelines, researcher communications, remediation status, and follow-up actions.

Languages