Bug Bounty Hunter (M/F)

免费注册后解锁"你的匹配分 vs 高分画像"与个人技能缺口。

We are looking for a permanent Bug Bounty Hunter (M/F), based in Montpellier, Valbonne, or working fully remotely. What we can achieve together: Septeo 's Red Team has transformed the way it operates. Vulnerability research no longer relies on occasional, manually executed campaigns, but on agentic offensive workflows : chains of agents that continuously explore the exposed attack surface, test applications, analyse code and verify fixes. This shift changes where the value lies: what matters today is no longer the number of testing hours, but the quality of the tools and capabilities designed, together with the judgement used to steer them. Reporting to the Head of Offensive Security R D, your role will cover two core areas: building, stabilising and maintaining vulnerability detection tools and processes; and working closely with the Group’s Product Owners, DTOs, developers and CISOs to share findings, support remediation and strengthen security practices. Your work will be built around three systems that currently structure our offensive security capabilities: An AI-powered internal EASM platform: continuous discovery of the exposed attack surface, asset qualification and ownership mapping, and identification of attack chains. Agentic SAST : continuous code analysis and repository-specific remediation proposals, rather than generic recommendations. A vulnerability lifecycle management platform: from initial finding to automated retesting and management-level reporting. You will operate, strengthen and continuously improve these systems. From day one, you will also identify and design what is missing: you will not simply execute a roadmap, but help shape it. Your day-to-day responsibilities: Design, develop and enhance offensive tools and workflows, including their architecture, scope, guardrails and stop conditions. Deploy, stabilise and maintain them with a Dev/DevOps mindset, covering pipelines, CI/CD, monitoring and continuous reliability improvements. Operate them on a daily basis: schedule, launch and monitor workflows; diagnose agent drift; triage false positives; and restore systems after incidents. Prototype quickly, measure tangible value and decide what should be industrialised or discontinued. Work regularly with the Group’s Product Owners, DTOs, developers and CISOs to qualify vulnerabilities, turn findings into actionable information and track remediation. Document design decisions, including guardrails that were considered but not retained and the reasons behind those choices. Propose and design the next capabilities that will help strengthen the Group’s security posture. Could this be you? First and foremost, you have a background as a Hunter, Bug Bounty Hunter or security researcher. You know how to explore an attack surface, identify non-obvious exploitation paths and distinguish a genuinely exploitable vulnerability from scanner noise. A strong bug bounty track record or freelance security experience will be highly valued. You have hands-on experience applying AI to security , including agents, automation, tool development and advanced use of AI models. Rather than limiting yourself to manual testing, you can define what needs to be built, guide a coding agent, review its output and assess whether it is robust. Here, sound judgement and the ability to improve the toolset matter more than expertise in any particular programming language. You are experienced in orchestrating agentic workflows: chaining and monitoring agents, understanding why a workflow is drifting and correcting it. You are also comfortable with production deployment and product stabilisation, including pipelines, CI/CD, monitoring and continuous improvement. Concrete achievements will matter more than a list of tools. You are highly autonomous, able to move forward without constant guidance, quickly understand an objective even when it is not perfectly defined, and turn an idea into an operational solution. You can also communicate effectiv

我们正在寻找一名常驻蒙彼利埃、瓦尔邦讷或完全远程工作的正式漏洞赏金猎人（男/女）。我们能够共同实现的目标：Septeo的红队已经改变了其运作方式。漏洞研究不再依赖于偶尔手动执行的行动，而是依赖于代理式攻击工作流：由智能体链持续探索暴露的攻击面、测试应用程序、分析代码并验证修复。这一转变改变了价值所在：如今重要的不再是测试小时数，而是所设计的工具和能力质量，以及引导它们时所用的判断力。向进攻性安全研发负责人汇报，你的角色将涵盖两个核心领域：构建、稳定和维护漏洞检测工具与流程；以及与集团的产品负责人、DTO、开发人员和CISO密切合作，分享发现、支持修复并加强安全实践。你的工作将围绕目前构成我们进攻性安全能力的三个系统展开：一个AI驱动的内部EASM平台：持续发现暴露的攻击面、资产鉴定与归属映射，以及识别攻击链。代理式SAST：持续进行代码分析并提出针对特定代码库的修复建议，而非通用建议。一个漏洞生命周期管理平台：从初始发现到自动化复测和管理层报告。你将运营、加强并持续改进这些系统。从第一天起，你还将识别并设计缺失的部分：你不会只是执行路线图，而是帮助塑造它。你的日常职责：设计、开发和增强进攻性工具与工作流，包括其架构、范围、防护措施和停止条件。以Dev/DevOps思维部署、稳定和维护它们，涵盖流水线、CI/CD、监控和持续可靠性改进。日常运营它们：调度、启动和监控工作流；诊断智能体漂移；分类误报；并在事件后恢复系统。快速制作原型，衡量实际价值，并决定哪些应该产业化或终止。定期与集团的产品负责人、DTO、开发人员和CISO合作，以鉴定漏洞、将发现转化为可操作信息并跟踪修复。记录设计决策，包括曾考虑但未保留的防护措施及其原因。提出并设计下一批有助于加强集团安全态势的能力。这个人会是你吗？首先，你拥有猎人、漏洞赏金猎人或安全研究员的背景。你知道如何探索攻击面、识别非显而易见的利用路径，并区分真正可利用的漏洞与扫描器噪声。强大的漏洞赏金记录或自由职业安全经验将受到高度重视。你拥有将AI应用于安全的实践经验，包括智能体、自动化、工具开发和AI模型的高级使用。你不局限于手动测试，而是能够定义需要构建什么、指导编码智能体、审查其输出并评估其是否稳健。在这里，良好的判断力和改进工具集的能力比任何特定编程语言的专业知识都更重要。你在编排代理式工作流方面经验丰富：链接和监控智能体、理解工作流为何漂移并加以纠正。你也熟悉生产部署和产品稳定化，包括流水线、CI/CD、监控和持续改进。具体成就比工具清单更重要。你高度自主，能够在没有持续指导的情况下向前推进，即使目标未被完美定义也能快速理解，并将想法转化为可操作的解决方案。你还能有效沟通

⚑ 岗位信息收录自公开招聘页（Himalayas），以雇主官网为准