Manage Mastercard’s Bug Bounty Program, validate and triage reported vulnerabilities, conduct penetration testing across web, mobile, and API applications, assess risk, guide remediation, validate fixes, and develop security metrics and reporting.
Our Purpose
Mastercard powers economies and empowers people in 200+ countries and territories worldwide. Together with our customers, we're helping build a sustainable economy where everyone can prosper. We support a wide range of digital payments choices, making transactions secure, simple, smart and accessible. Our technology and innovation, partnerships and networks combine to deliver a unique set of products and services that help people, businesses and governments realize their greatest potential.
Title and Summary
Senior Vulnerability Analyst
Overview
Mastercard is seeking a Senior Vulnerability Analyst to manage the Bug Bounty Program and perform advanced application security testing across web, mobile, and API environments. This role is responsible for validating externally reported vulnerabilities, conducting penetration testing, partnering with engineering teams on remediation, and helping strengthen Mastercard's security posture through proactive security assessments and vulnerability management.
Role• Manage the Bug Bounty Program, including vulnerability intake, validation, triage, and researcher engagement.• Conduct penetration testing of web, mobile, and API-based applications.• Assess risk, prioritize findings, and provide remediation guidance.• Partner with product and engineering teams to drive timely remediation and validate fixes.• Develop reporting and metrics to measure program effectiveness and communicate risk.
All About You• At least 3 years of experience in application security and penetration testing• Strong knowledge of web, mobile, and API security, including OWASP Top 10 risks.• Hands-on experience with tools such as Burp Suite, OWASP ZAP, or similar testing platforms.• Ability to assess vulnerabilities, communicate risk, and provide actionable remediation guidance.• Strong stakeholder management, analytical, and problem-solving skills.• Experience with bug bounty or vulnerability disclosure programs and relevant security certifications is a plus.
Corporate Security Responsibility
All activities involving access to Mastercard assets, information, and networks comes with an inherent risk to the organization and, therefore, it is expected that every person working for, or on behalf of, Mastercard is responsible for information security and must:
Mastercard powers economies and empowers people in 200+ countries and territories worldwide. Together with our customers, we're helping build a sustainable economy where everyone can prosper. We support a wide range of digital payments choices, making transactions secure, simple, smart and accessible. Our technology and innovation, partnerships and networks combine to deliver a unique set of products and services that help people, businesses and governments realize their greatest potential.
Title and Summary
Senior Vulnerability Analyst
Overview
Mastercard is seeking a Senior Vulnerability Analyst to manage the Bug Bounty Program and perform advanced application security testing across web, mobile, and API environments. This role is responsible for validating externally reported vulnerabilities, conducting penetration testing, partnering with engineering teams on remediation, and helping strengthen Mastercard's security posture through proactive security assessments and vulnerability management.
Role• Manage the Bug Bounty Program, including vulnerability intake, validation, triage, and researcher engagement.• Conduct penetration testing of web, mobile, and API-based applications.• Assess risk, prioritize findings, and provide remediation guidance.• Partner with product and engineering teams to drive timely remediation and validate fixes.• Develop reporting and metrics to measure program effectiveness and communicate risk.
All About You• At least 3 years of experience in application security and penetration testing• Strong knowledge of web, mobile, and API security, including OWASP Top 10 risks.• Hands-on experience with tools such as Burp Suite, OWASP ZAP, or similar testing platforms.• Ability to assess vulnerabilities, communicate risk, and provide actionable remediation guidance.• Strong stakeholder management, analytical, and problem-solving skills.• Experience with bug bounty or vulnerability disclosure programs and relevant security certifications is a plus.
Corporate Security Responsibility
All activities involving access to Mastercard assets, information, and networks comes with an inherent risk to the organization and, therefore, it is expected that every person working for, or on behalf of, Mastercard is responsible for information security and must:
- Abide by Mastercard's security policies and practices;
- Ensure the confidentiality and integrity of the information being accessed;
- Report any suspected information security violation or breach, and
- Complete all periodic mandatory security trainings in accordance with Mastercard's guidelines.
Similar Jobs at Mastercard
Blockchain • Fintech • Payments • Consulting • Cryptocurrency • Cybersecurity • Quantum Computing
Manages Mastercard’s Bug Bounty Program, validates and triages reported vulnerabilities, conducts penetration testing across web, mobile, and API applications, assesses risk, and guides engineering teams through remediation. The role also develops security metrics, validates fixes, communicates risk to stakeholders, and strengthens the organization’s overall application security posture.
Top Skills:
Api SecurityBurp SuiteMobile Application SecurityOwasp Top 10Owasp ZapWeb Application Security
Blockchain • Fintech • Payments • Consulting • Cryptocurrency • Cybersecurity • Quantum Computing
Own product strategy and end-to-end feature development for Mastercard’s Test & Learn experimentation platform. Responsibilities include researching users and markets, prioritizing problems, defining use cases, writing requirements, developing roadmaps, collaborating with UX designers and engineers, supporting testing, and measuring product impact.
Top Skills:
Data AnalyticsTest & Learn Platform
Blockchain • Fintech • Payments • Consulting • Cryptocurrency • Cybersecurity • Quantum Computing
Develops production-ready agentic AI systems and scalable software integrations in an R&D environment. The engineer designs multi-agent workflows, tool-using agents, and orchestration systems; evaluates AI models; applies emerging standards such as MCP, AGENTS.md, and SKILLS; and uses AI throughout the software development lifecycle. Responsibilities also include Java and Spring Boot development, REST APIs, UI frameworks, containerization, Kubernetes, CI/CD, security practices, stakeholder communication, and monitoring emerging AI technologies.
Top Skills:
Agentic AiAgents.MdAngularCi/CdClaudeDockerGithub CopilotJavaJdk 21KubernetesMcpNext.JsOpenai CodexReactRestful ApisSkillsSonarqubeSpring BootWeb Standards
What you need to know about the Edinburgh Tech Scene
From traditional pubs and centuries-old universities to sleek shopping malls and glass-paneled office buildings, Edinburgh's architecture reflects its unique blend of history and modernity. But the fusion of past and future isn't just visible in its buildings; it's also shaping the city's economy. Named the United Kingdom's leading technology ecosystem outside of London, Edinburgh plays host to major global companies like Apple and Adobe, as well as a growing number of innovative startups in fields like cybersecurity, finance and healthcare.
