Job Duties and Responsibilities

• Research and participate in authorized public and private bug bounty programs.

• Analyze program scope, rules, exclusions, and testing policies before beginning research.

• Perform reconnaissance, subdomain and asset discovery, endpoint enumeration, and attack-surface analysis.

• Conduct manual and tool-assisted security testing of web applications and APIs.

• Identify and validate vulnerabilities including IDOR/BOLA, broken access control, authentication/authorization flaws, privilege escalation, business-logic vulnerabilities, API vulnerabilities, XSS, SQL Injection, SSRF, CSRF, SSTI, file-upload issues, information disclosure, OAuth/JWT issues, race conditions, security misconfigurations, and subdomain takeover.

• Use tools such as Burp Suite, OWASP ZAP, Nmap, ffuf, and custom scripts effectively.

• Develop automation using Python, Bash, JavaScript, or similar technologies to improve research efficiency.

• Validate findings and eliminate false positives, duplicates, informational findings, and out-of-scope issues before submission.

• Prepare explicit, technically accurate, reproducible vulnerability reports with proof of concept, impact, severity, and remediation recommendations.

• Communicate professionally with program owners and triage teams.

• Track submissions, accepted/rejected reports, duplicate rates, bounty amounts, and research outcomes.

• Identify high-value programs and opportunities to maximize the company's monthly and quarterly bug bounty revenue.

• Continuously improve internal research methodologies, tooling, and security knowledge.

• Collaborate with and mentor other security researchers when required.

Required Qualifications Knowledge, Skills, and Abilities





• Strong practical knowledge of web application and API security.

• Excellent understanding of HTTP/HTTPS, REST APIs, authentication, authorization, sessions, JWT, OAuth/OIDC, SQL, JavaScript, Linux, and networking.

• Strong knowledge of OWASP Top 10 and modern application-security vulnerabilities.

• Advanced manual testing and vulnerability-analysis capabilities.

• Strong analytical, problem-solving, and research skills.

• Ability to understand complex application workflows and identify business-logic weaknesses.

• Strong technical report-writing and communication skills.

• Ability to distinguish genuine, high-impact vulnerabilities from low-value or invalid findings. Experience

• Minimum 3+ years of experience in bug bounty hunting, application security, penetration testing, vulnerability research, VAPT, offensive security, or related fields.

• Experience with platforms such as HackerOne, Bugcrowd, Intigriti, YesWeHack, or Immunefi is preferred.

• Candidates should demonstrate valid/accepted vulnerability research experience or equivalent professional security-testing experience.

Education

Bachelor's degree or equivalent qualification in Computer Science, IT, Cybersecurity, Information Security, Computer Engineering, or a related technical field. Strong practical experience may compensate for a non-security-specific degree.

Preferred Qualifications

• Proven history of accepted bug bounty reports.

• Experience discovering high/critical-severity vulnerabilities.

• Strong experience in business logic, authorization, and API vulnerabilities.

• Private bug bounty program experience.

• Strong Python/Bash/JavaScript scripting skills.

• Security certifications such as OSCP, OSWE, OSEP, BSCP, eWPT, PNPT, or equivalent are advantageous but not mandatory.

📌 Bug Bounty Specialist (New Delhi)
🏢 Correm Advisory India
📍 New Delhi