FewerJobs.
All jobs

Product Security Engineer (PSIRT - Product Security Incident Response Team)

Replit - Foster City, CA | Hybrid | Remote

Posted Jun 7, 2026

Benefits

Parental leave
Not verified
Non-birth-parent leave
Not verified
Family-building benefits
  • Fertility benefits: Not verified
  • Adoption assistance: Not verified
  • Surrogacy assistance: Not verified
Mental health support
Not verified
Relocation assistance
Not verified
Childcare support
Not verified
Learning budget
Not verified
Verification
Not verified
Salary
Not verified
401(k) match
Not verified

Was this benefit information wrong? Tell us.

Role

Role function
Security From the posting source checked Jun 20, 2026
Seniority
Mid From the posting source checked Jun 20, 2026
Work mode
Hybrid From the posting source checked Jun 20, 2026
In-office days
2 days From the posting source checked Jun 20, 2026

Schedule

Shift type
Not verified
Weekend work
Not verified

Application

Cover letter
Not verified
Assessment
Not verified
Deadline
Not stated

Where they hire

State eligibility is not yet verified.

About this role

Product Security Engineer (PSIRT - Product Security Incident Response Team) Foster City, CA | Hybrid | Remote Replit is the agentic software creation platform that enables anyone to build applications using natural language. With millions of users worldwide, Replit is democratizing software development by removing traditional barriers to application creation. ABOUT THE ROLE We are looking for a highly skilled PSIRT Engineer to lead the vulnerability response program for Replit's cloud-native AI platform. You will own the lifecycle of security vulnerabilities affecting our products and services-from intake to validation, remediation coordination, and public disclosure. This role requires strong technical ability to reproduce vulnerabilities, deep understanding of web/app/cloud exploit classes, and experience operating bug bounty and coordinated disclosure programs. You will work closely with Engineering, Cloud Security, SecOps, SRE, and IT teams to ensure vulnerabilities are fixed quickly and communicated responsibly. WHAT YOU'LL DO VULNERABILITY INTAKE, TRIAGE & VALIDATION - Manage intake from bug bounty platforms (HackerOne preferred), customer reports, automated scanners, pentest reports, and coordinated disclosure channels. - Independently validate, reproduce, severity-score, and document findings. - Identify duplicates and maintain a clean vulnerability records pipeline. - Assess relevance and exploitability using OWASP, cloud misconfiguration patterns, and identity/authentication/authorization risks (Oauth, OIDC). REMEDIATION COORDINATION & SLA MANAGEMENT - Work with Engineering, SecOps, IT, SRE, and Cloud Security to confirm product impact and drive remediation. - Provide detailed reproduction steps, proof-of-concepts, and technical analyses. - Track SLAs, remediation progress, regression testing, and systemic improvements. - Support SOC 2, ISO 27001, and pentest evidence

Read the full description at jobs.ashbyhq.com. FewerJobs shows a preview and links to the original posting.

Apply at jobs.ashbyhq.com

Apply link not verified; last-live date unavailable.

What verified means

Verified means a displayed claim has field-level provenance to a source FewerJobs pulled: a government or employer source, or the original job posting. Posting-sourced facts are employer-stated and are labeled separately from government records.

Related jobs