Intermediate Security Analyst, Vulnerability Operations (North America)

Joins the Vulnerability Operations team in GitLab's Product Security group, the main contact point for outside security researchers. This early-career analyst triages bug bounty submissions and findings from vulnerability management, checks validity and impact, spots duplicates and routes issues to their owners, then follows them through to closure. The role also supports GitLab's work as a CVE Numbering Authority, drafts customer notices about vulnerabilities and fixes with PSIRT, Legal and Communications, keeps records and runbooks current, and watches queue metrics for trends.

The team wants a grounding in web, API and CI/CD security, familiarity with CVE, CVSS, CWE and OWASP, and clear writing; HackerOne or Bugcrowd experience helps. Open across North America, with West Coast candidates preferred for Pacific time coverage.