- Level
- Senior
- Experience
- 3+ years
- Work style
- Not stated
- Full-time
- Area
- Offensive security
At a glance
The role in plain English
This Senior Vulnerability Analyst role focuses on managing Mastercard's Bug Bounty Program and conducting advanced security testing for web, mobile, and API applications. The position suits experienced application security professionals who enjoy hands-on testing, risk assessment, and collaborating with engineering teams to remediate vulnerabilities. Day-to-day work includes validating reported vulnerabilities, performing penetration tests, prioritising findings, and developing metrics to track program effectiveness.
What you'll do
- Manage Bug Bounty Program intake, validation, and triage
- Conduct penetration testing on web, mobile, and API applications
- Assess risk and prioritise vulnerability findings
- Provide remediation guidance to engineering teams
- Develop reporting and metrics for program effectiveness
What they're looking for
Essential
- 3+ years in application security or penetration testing
- Knowledge of web, mobile, and API security
- Experience with Burp Suite, OWASP ZAP, or similar tools
- Ability to assess vulnerabilities and communicate risk
Nice to have
- Experience with bug bounty or disclosure programs
- Relevant security certifications
Core skills
- Application security
- Penetration testing
- Burp Suite
- OWASP ZAP
- Risk assessment
- Remediation guidance
- Bug bounty management
The shape of the job
Technical depth
4/5
Pace
3/5
Ownership
4/5
Teamwork
4/5
Cyberend's reading of the listing, not the employer's own scores.
Application toolkit
Make your application count
See which requirements your CV meets and what is missing.
Your CV is used for this answer only and never stored.
Questions to prepare for
- 01How do you validate and triage vulnerabilities reported through a bug bounty program?
- 02Describe your approach to penetration testing a new API-based application.
- 03What steps do you take to prioritise remediation of vulnerabilities?
- 04How do you communicate technical risk and remediation guidance to engineering teams?
About Mastercard
Mastercard provides digital payment solutions and services in over 200 countries and territories.
Full job descriptionAs published by Mastercard
Our Purpose
Mastercard powers economies and empowers people in 200+ countries and territories worldwide. Together with our customers, we’re helping build a sustainable economy where everyone can prosper. We support a wide range of digital payments choices, making transactions secure, simple, smart and accessible. Our technology and innovation, partnerships and networks combine to deliver a unique set of products and services that help people, businesses and governments realize their greatest potential.
Title and Summary
Senior Vulnerability Analyst
Overview Mastercard is seeking a Senior Vulnerability Analyst to manage the Bug Bounty Program and perform advanced application security testing across web, mobile, and API environments. This role is responsible for validating externally reported vulnerabilities, conducting penetration testing, partnering with engineering teams on remediation, and helping strengthen Mastercard's security posture through proactive security assessments and vulnerability management.
Role • Manage the Bug Bounty Program, including vulnerability intake, validation, triage, and researcher engagement. • Conduct penetration testing of web, mobile, and API-based applications. • Assess risk, prioritize findings, and provide remediation guidance. • Partner with product and engineering teams to drive timely remediation and validate fixes. • Develop reporting and metrics to measure program effectiveness and communicate risk.
All About You • At least 3 years of experience in application security and penetration testing • Strong knowledge of web, mobile, and API security, including OWASP Top 10 risks. • Hands-on experience with tools such as Burp Suite, OWASP ZAP, or similar testing platforms. • Ability to assess vulnerabilities, communicate risk, and provide actionable remediation guidance. • Strong stakeholder management, analytical, and problem-solving skills. • Experience with bug bounty or vulnerability disclosure programs and relevant security certifications is a plus.
Corporate Security Responsibility
All activities involving access to Mastercard assets, information, and networks comes with an inherent risk to the organization and, therefore, it is expected that every person working for, or on behalf of, Mastercard is responsible for information security and must:
- Abide by Mastercard’s security policies and practices;
- Ensure the confidentiality and integrity of the information being accessed;
- Report any suspected information security violation or breach, and
- Complete all periodic mandatory security trainings in accordance with Mastercard’s guidelines.