Job Duties and Responsibilities

- Research and participate in authorized public and private bug bounty programs.
- Analyze program scope, rules, exclusions, and testing policies before beginning research.
- Perform reconnaissance, subdomain and asset discovery, endpoint enumeration, and attack-surface analysis.
- Conduct manual and tool-assisted security testing of web applications and APIs.
- Identify and validate vulnerabilities including IDOR/BOLA, broken access control, authentication/authorization flaws, privilege escalation, business-logic vulnerabilities, API vulnerabilities, XSS, SQL Injection, SSRF, CSRF, SSTI, file-upload issues, information disclosure, OAuth/JWT issues, race conditions, security misconfigurations, and subdomain takeover.
- Use tools such as Burp Suite, OWASP ZAP, Nmap, ffuf, and custom scripts effectively.
- Develop automation using Python, Bash, JavaScript, or similar technologies to improve research efficiency.
- Validate findings and eliminate false positives, duplicates, informational findings, and out-of-scope issues before submission.
- Prepare clear, technically accurate, reproducible vulnerability reports with proof of concept, impact, severity, and remediation recommendations.
- Communicate professionally with program owners and triage teams.
- Track submissions, accepted/rejected reports, duplicate rates, bounty amounts, and research outcomes.
- Identify high-value programs and opportunities to maximize the company's monthly and quarterly bug bounty revenue.
- Continuously improve internal research methodologies, tooling, and security knowledge.
- Collaborate with and mentor other security researchers when required.

Required Qualifications Knowledge, Skills, and Abilities





- Strong practical knowledge of web application and API security.
- Excellent understanding of HTTP/HTTPS, REST APIs, authentication, authorization, sessions, JWT, OAuth/OIDC, SQL, JavaScript, Linux, and networking.
- Strong knowledge of OWASP Top 10 and modern application-security vulnerabilities.
- Advanced manual testing and vulnerability-analysis capabilities.
- Strong analytical, problem-solving, and research skills.
- Ability to understand complex application workflows and identify business-logic weaknesses.
- Strong technical report-writing and communication skills.
- Ability to distinguish genuine, high-impact vulnerabilities from low-value or invalid findings. Experience
- Minimum 3+ years of experience in bug bounty hunting, application security, penetration testing, vulnerability research, VAPT, offensive security, or related fields.
- Experience with platforms such as HackerOne, Bugcrowd, Intigriti, YesWeHack, or Immunefi is preferred.
- Candidates should demonstrate valid/accepted vulnerability research experience or equivalent qualified security-testing experience.

Education

Bachelor's degree or equivalent qualification in Computer Science, IT, Cybersecurity, Information Security, Computer Engineering, or a related technical field. Strong practical experience may compensate for a non-security-specific degree.

Preferred Qualifications

- Proven history of accepted bug bounty reports.
- Experience discovering high/critical-severity vulnerabilities.
- Strong experience in business logic, authorization, and API vulnerabilities.
- Private bug bounty program experience.
- Strong Python/Bash/JavaScript scripting skills.
- Security certifications such as OSCP, OSWE, OSEP, BSCP, eWPT, PNPT, or equivalent are advantageous but not mandatory.

📌 Bug Bounty Specialist (New Delhi)
🏢 Correm Advisory India
📍 New Delhi