Program Manager (Vulnerability Discovery)

About the role

Neutron is looking for a Programme Manager to lead our Crowdsourced Vulnerability Discovery Programmes (CVDP) — a suite of three programmes that help government agencies find and fix security vulnerabilities: the Government Bug Bounty Programme (GBBP), the Vulnerability Rewards Programme (VRP), and the Vulnerability Disclosure Programme (VDP). You'll own the planning, execution, and monitoring of these programmes end to end, working closely with government agencies, the security researcher community, and our appointed bug bounty vendor to keep every programme running smoothly. It's a role for someone who enjoys bringing structure to complex, multi-stakeholder work and who's excited to use new tools — including AI — to make things run better.

Key responsibilities

• Plan, schedule, and oversee GBBP, VRP, and VDP programme runs
• Coordinate with government agencies on programme participation, scoping, and timelines — following up to ensure required data and documentation are submitted on time
• Manage the end-to-end vendor relationship, including contract administration, performance monitoring, and issue escalation — covering preparation of each bug bounty run and researcher onboarding (recruitment, vetting, and test account provisioning)
• Support the triage team with reporting, and coordinate with agencies to resolve any disputes
• Support procurement and tender exercises, including drafting requirement specifications and evaluating vendor proposals
• Prepare programme reports, dashboards, and management updates for stakeholders
• Drive stakeholder communications and outreach, such as agency briefings, to raise awareness and grow participation
• Proactively identify and lead process improvements across CVDP operations — including using AI-assisted development and approved GovTech platforms to automate workflows, improve reporting, and boost efficiency

About you

• At least 5 years of experience managing IT or technology programmes/projects (experience with a bug bounty, vulnerability disclosure, or cybersecurity programme is a strong plus)
• Strong project management skills to plan, execute, and monitor programme operations
• Good written and verbal communication in English, with the ability to explain technical findings to non-technical stakeholders
• Experience managing vendors or contracts, including tracking deliverables and service levels
• Comfortable working with data to track metrics and produce management reports
• A track record of proposing and implementing process improvements, including using AI-assisted development or approved digital platforms to streamline operations
• Singapore Citizen or Permanent Resident, as the role involves handling government systems and data requiring security clearance eligibility
• PMP, CITPM, or an equivalent project management certification (nice to have)
• Familiarity with vulnerability management, penetration testing, or bug bounty concepts (nice to have)
• Experience working with or within the public sector (nice to have)