Product Security Engineer (PSIRT - Product Security Incident Response Team)
Replit · Foster City, CA · 3 wk ago
Information TechnologyFull-time
We need to output HTML fragment with sections: About the role, Responsibilities (What You'll Do), Requirements (Required Skills), Qualifications maybe? The posting includes "Nice to Have" maybe as part of Qualifications? We'll include sections only if content present.
We must not repeat job title. No Job ID. Remove boilerplate: navigation, cookie, legal, EEO, etc. The text includes some fluff at end: "Want to learn more about what we are up to? Self-driving Company..." That's likely boilerplate; we should remove. Also "Interviewing + Culture at Replit Operating PrinciplesReasons not to work at Replit ..." Also remove.
We need to preserve substantive info: About The Role paragraph, What You'll Do bullet list (but we need to convert to
- ). Required Skills bullet list. Nice to Have maybe as part of Qualifications or Skills? Could be separate "Nice to Have" but we can include under Requirements or Qualifications. The instruction: Use headings for section headings e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. We have Benefits listed: "Full-Time Employee Benefits Include Competitive Salary & Equity 401(k) Program with a 4% match (US Only) ⚕️ Health, Dental, Vision and Life Insurance Short Term and Long Term Disability Paid Parental, Medical, Caregiver Leave Flexible Time Off (FTO) + Holidays Commuter Benefits (In-Office & US Only) Monthly Wellness Stipend Autonomous Work Environment In Office Set-Up Reimbursement (In-Office Only) Quarterly Team Gatherings ☕ In Office Amenities (In-Office Only)". That's benefits. Also schedule: "This is a full-time role that can be held from our Foster City, CA office. The role has an in-office requirement of Monday, Wednesday, and Friday." That's schedule. Pay: Not explicitly given besides "Competitive Salary & Equity". That's part of benefits but could be Pay section. The instruction: create Pay/Schedule/Benefits sections only if posting actually states them. It does state Competitive Salary & Equity, so we can include Pay section with that. Benefits section with other benefits. Schedule section with in-office requirement. We must not include filler like "commensurate with experience". Not present. We need to preserve all substantive info. Let's extract: About The Role: "We are looking for a highly skilled PSIRT Engineer to lead the vulnerability response program for Replit’s cloud-native AI platform. You will own the lifecycle of security vulnerabilities affecting our products and services—from intake to validation, remediation coordination, and public disclosure. This role requires strong technical ability to reproduce vulnerabilities, deep understanding of web/app/cloud exploit classes, and experience operating bug bounty and coordinated disclosure programs. You will work closely with Engineering, Cloud Security, SecOps, SRE, and IT teams to ensure vulnerabilities are fixed quickly and communicated responsibly." What You'll Do: bullet points (the paragraphs after "What You’ll Do"). Let's list them: - Vulnerability Intake, Triage & Validation Manage intake from bug bounty platforms (HackerOne preferred), customer reports, automated scanners, pentest reports, and coordinated disclosure channels. Independently validate, reproduce, severity-score, and document findings. Identify duplicates and maintain a clean vulnerability records pipeline. Assess relevance and exploitability using OWASP, cloud misconfiguration patterns, and identity/authentication/authorization risks (Oauth, OIDC). - Remediation Coordination & SLA Management Work with Engineering, SecOps, IT, SRE, and Cloud Security to confirm product impact and drive remediation. Provide detailed reproduction steps, proof-of-concepts, and technical analyses. Track SLAs, remediation progress, regression testing, and systemic improvements. Support SOC 2, ISO 27001, and pentest evidence needs as part of vulnerability lifecycle governance. - Bug Bounty & Vulnerability Disclosure Program Management Design and evolve the bug bounty program, including scope, rules, and reward structures. Manage platform selection, private vs. public launches, and community engagement. Communicate clearly with researchers, provide clarifications, and handle feedback or disputes. Determine reward payouts, bonus decisions, and recognition for top contributors. - Coordinated Disclosure & CVE Management Lead the coordinated vulnerability disclosure process for internal and external findings. Negotiate disclosure timelines with researchers and partners. Coordinate CVE assignments and publications, and prepare customer/public advisories. We need to convert each bullet into
- maybe grouping? Could treat each top-level bullet as a
- containing subpoints? Simpler: each line as
- . We'll keep the description inside
- . Might be long but okay.
Required Skills: list:
- Experience running or triaging for bug bounty programs (HackerOne ideally).
- Strong ability to triage, validate, and reproduce vulnerabilities independently.
- Deep understanding of web/app/cloud vulnerability classes, OWASP Top 10, misconfigurations, authN/Z issues, etc.
- Familiarity with cloud platforms (GCP preferred) and SaaS architectures.
- Strong understanding of CI/CD workflows, code structure, and software engineering fundamentals.
Nice to Have: list:
- Scripting or automation experience (Python, Go, Bash).
- Pentesting background or exposure to offensive security work.
- Familiarity with compliance frameworks such as SOC 2 and ISO 27001.
- Experience authoring public advisories or CVE writeups.
- Hands-on experience with SIEM, Cloud Logging, and investigative tooling.
We could put Nice to Have under Qualifications or Skills. Since we have headings: Requirements, Qualifications, Skills. We could put Required Skills under Requirements, Nice to Have under Qualifications. Or combine under Skills. We'll follow typical: Requirements = Required Skills, Qualifications = Nice to Have. Or we could have Skills for both. But instruction: Use headings for section headings e.g. About the role, Responsibilities, Requirements, Qualifications, Skills, Benefits, Pay, Schedule. So we can include Requirements and Qualifications.
Benefits: list items.
Pay: "Competitive Salary & Equity". Could be just that sentence.
Schedule: "This is a full-time role that can be held from our Foster City, CA office. The role has an in-office requirement of Monday, Wednesday, and Friday."
We need to ensure we don't duplicate info. Also we should not include "Full-Time Employee Benefits Include" as heading; we will put Benefits section with list.
Let's craft HTML:
About the role
We are looking for a highly skilled PSIRT Engineer to lead the vulnerability response program for Replit’s cloud-native AI platform. You will own the lifecycle of security vulnerabilities affecting our products and services—from intake to validation, remediation coordination, and public disclosure. This role requires strong technical ability to reproduce vulnerabilities, deep understanding of web/app/cloud exploit classes, and experience operating bug bounty and coordinated disclosure programs. You will work closely with Engineering, Cloud Security, SecOps, SRE, and IT teams to ensure vulnerabilities are fixed quickly and communicated responsibly.
Responsibilities
- Vulnerability Intake, Triage & Validation – Manage intake from bug bounty platforms (HackerOne preferred), customer reports, automated scanners, pentest reports, and coordinated disclosure channels. Independently validate, reproduce, severity-score, and document findings. Identify duplicates and maintain a clean vulnerability records pipeline. Assess relevance and exploitability using OWASP, cloud misconfiguration patterns, and identity/authentication/authorization risks (Oauth, OIDC).
- Remediation Coordination & SLA Management – Work with Engineering, SecOps, IT, SRE, and Cloud Security to confirm product impact and drive remediation. Provide detailed reproduction steps, proof-of-concepts, and technical analyses. Track SLAs, remediation progress, regression testing, and systemic improvements. Support SOC 2, ISO 27001, and pentest evidence needs as part of vulnerability lifecycle governance.
- Bug Bounty & Vulnerability Disclosure Program Management – Design and evolve the bug bounty program, including scope, rules, and reward structures. Manage platform selection, private vs. public launches, and community engagement. Communicate clearly with researchers, provide clarifications, and handle feedback or disputes. Determine reward payouts, bonus decisions, and recognition for top contributors.
- Coordinated Disclosure & CVE Management – Lead the coordinated vulnerability disclosure process for internal and external findings. Negotiate disclosure timelines with researchers and partners. Coordinate CVE assignments and publications, and prepare customer/public advisories.
Requirements
- Experience running or triaging for bug bounty programs (HackerOne ideally).
- Strong ability to triage, validate, and reproduce vulnerabilities independently.
- Deep understanding of web/app/cloud vulnerability classes, OWASP Top 10, misconfigurations, authN/Z issues, etc.
- Familiarity with cloud platforms (GCP preferred) and SaaS architectures.
- Strong understanding of CI/CD workflows, code structure, and software engineering fundamentals.
Qualifications
- Scripting or automation experience (Python, Go, Bash).
- Pentesting background or exposure to offensive security work.
- Familiarity with compliance frameworks such as SOC 2 and ISO 27001.
- Experience authoring public advisories or CVE writeups.
- Hands-on experience with SIEM, Cloud Logging, and investigative tooling.
Benefits
- Competitive Salary & Equity
- 401(k) Program with a 4% match (US Only)
- Health, Dental, Vision and Life Insurance
- Short Term and Long Term Disability
- Paid Parental, Medical, Caregiver Leave
- Flexible Time Off (FTO) + Holidays
- Commuter Benefits (In-Office & US Only)
- Monthly Wellness Stipend
- Autonomous Work Environment
- In Office Set-Up Reimbursement (In-Office Only)
- Quarterly Team Gatherings
- In Office Amenities (In-Office Only)
Pay
Competitive Salary & Equity
Schedule
This is a full-time role that can be held from our Foster City, CA office. The role has an in-office requirement of Monday, Wednesday, and Friday.
We have duplicated Competitive Salary & Equity in Benefits and Pay; maybe we should not duplicate. Benefits list includes Competitive Salary & Equity as first item; Pay section could just mention that. It's okay but could be considered duplication. The instruction: Preserve ALL substantive information; do NOT invent or summarize away detail. Duplication is not prohibited but might be considered redundant. Better to keep Pay section with just that sentence and Benefits without that line. Let's adjust Benefits list to exclude Competitive Salary & Equity. Thus Benefits list items: - 401(k) Program with a 4% match (US Only) - Health, Dental, Vision and Life Insurance - Short Term and Long Term Disability - Paid Parental, Medical, Caregiver Leave - Flexible Time Off (FTO) + Holidays - Commuter Benefits (In-Office & US Only) - Monthly Wellness Stipend - Autonomous Work Environment - In Office Set-Up Reimbursement (In-Office Only) - Quarterly Team Gatherings - In Office Amenities (In-Office Only) Now Pay section: Competitive Sal