Luta Security is hiring Security Triage Managers to run technical triage for the bug bounty and vulnerability disclosure programs of some of the biggest companies in the world. These are remote contract roles, with hours based on customer program volume. Candidates must be located in the U.S. and eligible to work in the U.S. without sponsorship.

You will validate incoming reports hands-on, make severity calls based on real security impact, and bring software development and AI engineering skills to the team. Every valid finding is confirmed with a deterministic repro. Security Triage Managers with team leadership or mentoring experience may have the opportunity to lead a team of triage contractors, based on business need.

Responsibilities

• Own end-to-end case resolution of incoming security reports, including additional investigation
• Coordinate cases from intake to resolution with customer teams, security researchers, and other internal and external stakeholders
• Test researcher-supplied proofs of concept, reproduce reported vulnerabilities deterministically, and technically validate fixes
• Clarify researcher reports for developers when needed, including steps to reproduce
• Explain impact and remediation recommendations to developers based on researcher reports
• Make severity and impact judgment calls in the context of each customer's environment
• Write and maintain Standard Operating Procedures (SOPs)
• Develop software and AI automation as needed
• Communicate with security researchers and provide regular updates to Luta Security customers
• Calculate program metrics weekly, monthly, and quarterly
• Research current threats and vulnerabilities and author security advisories or summaries

Required

• Prior experience running or triaging a bug bounty or vulnerability disclosure program
• Hands-on penetration testing skills across web, API, mobile, cloud, or AI/LLM targets, with the ability to run and debug researcher-supplied proofs of concept and reproduce reported vulnerabilities deterministically without relying on AI tools to judge validity
• Development skills in Python or a similar language, with experience in prompt engineering, context engineering, and retrieval for LLM tools
• Working knowledge of CVSS and CWE
• Clear written and verbal communication, especially explaining impact and remediation to developers without a security background
• Working understanding of coordinated vulnerability disclosure and familiarity with ISO/IEC 29147 and 30111
• Agreement not to participate as a researcher in any program you triage

Preferred

• Public CVEs, bug bounty recognition, or offensive security certifications

Compensation

• Training period of up to 2 weeks at $50 USD/hour
• $90 to $150 USD/hour once training is complete and case responsibilities are assigned, based on technical skills and experience

To apply, send your resume and cover letter to careers@lutasecurity.com.