Latest AI JobsBrowse Jobs
HackerOne logo

Product Security Analyst

HackerOneWashington DCCustomer Operations
Apply on company site
Salary
$120K - $155K USD
Job type
Full-time
Work mode
Remote
Posted
18 Sept 2026
Status
Open · checked 7d ago

About this role

Role Overview

HackerOne is seeking a remote Product Security Analyst based in the Washington DC area to evaluate and validate security submissions from the global research community. This full-time position suits experienced ethical hackers and security testers with a background in application security and vulnerability triage.

Key Responsibilities

Review incoming security vulnerability reports from researchers to assess validity, severity, exploitability, and potential impact for clients.
Independently reproduce vulnerabilities across mobile and web platforms to determine root causes and document findings accurately.
Communicate directly with external security researchers to gather missing technical details and guide customers through the triage process.
Draft clear, concise summaries containing remediation advice, technical reproduction steps, and impact analyses.
Adapt quickly to shifting program scopes, new attack methods, and changing client environments.
Utilize automation and AI-driven workflows to streamline operational efficiency and improve triage quality.
Collaborate across internal teams to guarantee prompt vulnerability handling and an exceptional client experience.
Enhance internal documentation, tooling, and triage procedures to drive scalability.
Note that this position requires working on Saturdays and Sundays, with two designated weekdays off.

Requirements

Three or more years of practical background conducting ethical hacking, vulnerability research, or security testing on mobile and web applications.
Solid technical knowledge regarding standard application security flaws, including the OWASP Top 10.
Practical experience utilizing security testing utilities such as Burp Suite alongside vulnerability scoring frameworks like CVSS.
Exceptional written and spoken English communication abilities to bridge technical and non-technical stakeholders.
Willingness and availability to fulfill weekend work schedules involving Saturday and Sunday shifts.

Nice to Have

Background in taking part in vulnerability disclosure initiatives or bug bounty ecosystems.
Prior practice validating and reproducing security flaws reported by customers or outside researchers.
Acquaintance with automation scripts or coding languages applied in operational tasks and security assessments.
Proven capacity to balance competing tasks and sustain operational standards within a fast-moving, distributed corporate setting.

Skills and Tools

Application security
Vulnerability research and ethical hacking
OWASP Top 10
Burp Suite
CVSS scoring frameworks
Web and mobile application testing
Vulnerability triage and validation

Salary and Benefits

Annual compensation band for this regional tier ranges from $120,000 to $140,000 in USD.
Equity stock options included.
Comprehensive medical, dental, and vision health coverage alongside life and disability insurance.
Retirement plans and employee assistance programs.
Unlimited paid time off alongside paid public holidays.
Paid parental and maternity leave, plus specialized leaves of absence.

About the Company

HackerOne operates as a continuous threat exposure management enterprise that unites agentic AI capabilities with a large community of ethical security researchers. The organization assists global corporations in discovering, prioritizing, and fixing exposures spanning cloud, code, and artificial intelligence environments. Recognized for its workplace culture and leadership in AI security testing, the firm values transparency, customer obsession, and shared success among its team members.

How to Apply

Interested candidates should visit the official HackerOne careers page to submit their application for this remote opportunity.

Questions candidates ask

What is the location requirement for this role?

This is a remote position targeted for candidates who live within approximately 50 miles of Washington DC, as well as select other metropolitan areas such as Boston, Austin, Seattle, or the San Francisco Bay Area.

Are there any special scheduling requirements for this position?

Yes, this role requires working on both Saturday and Sunday, with two designated days off during the middle of the week, typically Tuesday, Wednesday, or Thursday.

How many years of experience are required?

Applicants must have a minimum of 3+ years of hands-on background in security testing, ethical hacking, or vulnerability research focused on web and mobile applications.

What salary can I expect for this role in Washington DC?

The compensation band for locations outside of the San Francisco Bay Area tier, which includes Washington DC, ranges from $120,000 to $140,000 per year, plus equity stock options.

What tools and frameworks should I be familiar with?

Candidates should have experience with security testing tools like Burp Suite, a solid understanding of the OWASP Top 10, and familiarity with vulnerability scoring systems such as CVSS.

Ready to apply?

The application is on the official HackerOne careers page.

Apply on company site