Who you are

- Proven ability to follow bug reports and accurately triage security vulnerabilities

- Familiarity with web security issues and exploit methodologies (e.g., OWASP Top 10, CWEs)

- Competent in offensive security tools (e.g., Burp Suite, custom scripting)

- Ability to think like an attacker to understand the impact of vulnerabilities

- Proficient in explicit communication, conveying technical concepts to various stakeholders

- Experience in one of the following areas:

- Bug bounty program or triaging security vulnerability reports

- Knowledge of Stripe products and general security expertise

- Experience in technical support, operations, or similar roles with technical systems exposure

- Prior participation in or experience with bug bounty programs

- Experience analyzing source code for security vulnerabilities

- Proficiency in scripting languages (e.g., Python, Ruby) for automation

- Familiarity with cloud-based services (e.g., AWS, GCP)

- Certifications such as OSWA or BSCP

- At Stripe, we're looking for people with passion, grit, and integrity. You're encouraged to apply even if your experience doesn't precisely match the . Your skills and passion will stand out—and set you apart—especially if your career has taken some extraordinary twists and turns

What the job involves

- In this role, you’ll join Stripe’s Vulnerability Management team, whose mission is to “Surface vulnerabilities at scale across Stripe.” Our vision is to create a culture of continuous excellence in managing vulnerabilities. The bug bounty program is an important pillar of this mission, acting as a critical line of defense in Stripe’s security “immune system.”

- We seek a highly technical and detail-oriented Security Analyst to join our team, focusing on the front lines of bug bounty triage and researcher engagement. In this role,



you’ll be responsible for the end-to-end lifecycle of security vulnerability reports from our bug bounty program

- You’ll own the overall effectiveness of Stripe’s bug bounty program with autonomy to implement continuous improvements (e.g., researcher campaigns, scoring transparency)

- You’ll play a key role in understanding the root cause of vulnerabilities, coordinating timely resolutions, and directly impacting the security posture of Stripe’s products. A core aspect of this role is developing a deep understanding of Stripe and acquired company products, assets, and their configuration to effectively assess and prioritize vulnerabilities

- Analyze, assess, reproduce, and triage incoming security vulnerability reports from the bug bounty program

- Communicate clearly and effectively with security researchers to follow up on unclear reports, drive report clarity, and increase engagement with top hackers

- Understand the root cause of security vulnerabilities to help product and engineering teams fix them, and advise on the right mitigation strategies

- Drive the lifecycle of submissions through to resolution, coordinating with product and engineering stakeholders

- Act as the security bridge between external researchers and internal teams to facilitate rapid and effective remediation

- Conduct in-depth data analysis on bug reports and vulnerability patterns to identify systemic risks and inform new security initiatives

- Provide tactical support for vulnerability management triage processes to augment the team as needed

- Prepare and implement improvements to the overall bug bounty program

- Provide feedback and requirements for tool development to enhance triage and security workflows, leveraging opportunities for automation

Benefits

- Gym membership
- Food provided in the office

- Unlimited paid time off policy

- Work from home opportunities
- Comprehensive mental, physical and medical health plans

- Fertility benefits and parental leave

📌 Security Analyst (Canada)
🏢 Stripe
📍 Canada