Application Security Program Manager

LOCAL to Bay Area based resources only.

Client's Cybersecurity is seeking a highly technical contractor to own and drive application security vulnerability remediation programs, with an initial focus on HackerOne bug bounty findings, API security vulnerabilities, GraphQL authorization issues, and cross-functional remediation tracking.

The role will serve as the operational owner of the vulnerability remediation lifecycle, coordinating across Cybersecurity, Engineering, Product, and external vendors to ensure timely identification, validation, assignment, remediation, and closure of security findings.

Bug Bounty Program Management

• Own day-to-day management of the HackerOne program. Manage vulnerability intake, triage, validation, routing, tracking, and closure. Coordinate weekly operating reviews with HackerOne and internal stakeholders. Track remediation commitments and drive accountability. Manage disclosure and communication processes.

Technical Security Validation

• Reproduce and validate reported vulnerabilities. Assess exploitability and business impact. Understand web application, API, GraphQL, authentication, and authorization issues. Utilize Postman, browser tooling, and security testing tools to validate findings. Support vulnerability prioritization based on customer and business risk.Remediation Program Leadership
• Coordinate remediation efforts across multiple engineering organizations. Work with engineering managers, technical leads, and product owners. Identify service ownership and route findings appropriately. Maintain Jira and ServiceNow tracking. Escalate critical and overdue items.Reporting & Metrics
• Produce executive-level reporting and dashboards. Track backlog trends, SLA compliance, remediation progress, and risk reduction. Present status updates to cybersecurity and engineering leadership.

Automation & AI

Leverage GenAI and workflow automation to improve: Vulnerability triage Remediation tracking Reporting Service ownership identification Repetitive program-management activities

Required Qualifications

Must Have: 5+ years experience in: Software Engineering or Application Security Strong understanding of: REST APIs, GraphQL, Authentication & Authorization, OAuth, JWT, OWASP Top 10, API Security Top 10. Experience reproducing security findings. Experience using Postman. Experience with Jira and ServiceNow. Strong stakeholder management skills.

Preferred HackerOne or Bug Bounty experience. AppSec experience. Penetration testing experience. Full-stack software development background. Burp Suite experience. GenAI automation experience.

Pay: $80.00 - $85.00 per hour

Expected hours: 40.0 per week

Work Location: In person