Associate Application Security Engineer - Bug Bounty & Vulnerability Management

• Regular
• Language Fluency: English (Required)
• Work Shift: 1st shift (United States of America)

Please review the following job description

Manages and triages submissions to the Bug Bounty program, validating reported vulnerabilities, assessing impact and severity, and coordinating remediation efforts with internal teams.

Applies cybersecurity expertise to analyze findings, identify trends, improve vulnerability response processes, and help strengthen the organization’s overall security posture while continuously expanding technical knowledge of emerging threats and attack techniques.

Telecommuting/Remote workstyle will be considered for well-qualified individuals located outside of the Truist footprint. Teammate will work hours supporting Eastern Standard Time

For this opportunity, Truist will not sponsor an applicant for work visa status or employment authorization, nor will we offer any immigration-related support for this position (including, but not limited to H-1B, F-1 OPT, F-1 STEM OPT, F-1 CPT, J-1, TN-1 or TN-2, E-3, O-1, or future sponsorship for U.

S. lawful permanent residence status.)

ESSENTIAL DUTIES AND RESPONSIBILITIES

• Reviews, validates, and triages vulnerability reports submitted through the Bug Bounty program, assessing risk, impact, exploitability, and business relevance.
• Partners with product, engineering, and security teams to investigate reported findings, coordinate remediation efforts, and verify resolution of identified vulnerabilities.
• Performs threat modeling, security testing, vulnerability analysis, and penetration testing activities to identify and assess security weaknesses across assigned platforms and services.
• Investigates security issues escalated within the team, conducts root cause analysis, and drives corrective actions that reduce recurring vulnerabilities and systemic risks.
• Provides technical guidance on vulnerability remediation, secure coding practices, and security design considerations to support secure-by-design principles.
• Reviews emerging threats, attack techniques, and vulnerability trends from internal assessments, bug bounty submissions, and external research to improve security controls and defensive capabilities.
• Supports the implementation and maintenance of security technologies, control frameworks, security baselines, and configuration standards across assigned systems and applications.
• Works with internal stakeholders to prioritize remediation activities based on severity, exploitability, business impact, and regulatory requirements.
• Assists with incident response, forensic investigations, and security assessments as needed, leveraging findings to improve detection, prevention, and response capabilities.
• Tracks and reports on vulnerability remediation progress, recurring security issues, and program metrics to support risk management and continuous improvement efforts.
• Plans and manages work activities to meet established objectives, continuously developing technical expertise in application security, vulnerability management, and offensive security techniques.

Qualifications

• Required Qualifications
• Bachelor’s degree or equivalent education, training, and work-related experience.
• Minimum of 3 years of experience in security engineering or related cybersecurity roles.
• Developing knowledge in cybersecurity principles, theories, and concepts.
• Experience in software development lifecycle security practices.
• Proficiency in implementing and managing information security technologies.
• Preferred Qualifications
• Experience participating in Bug Bounty Programs (BBP) and Vulnerability Disclosure Programs (VDP), including vulnerability triage, validation, and remediation coordination.
• Active involvement in the bug bounty, security research, or threat hunting community, with a demonstrated passion for discovering, analyzing, and understanding emerging security threats and attack techniques.
• Strong desire to continuously learn and expand technical expertise in application security, vulnerability research, offensive security methodologies, and security tooling.
• Familiarity with security automation, threat detection technologies, emerging cybersecurity trends, and risk-based approaches to vulnerability management and remediation.
• General Description of Available Benefits for Eligible Employees of
• Truist
• Financial

Corporation: All regular teammates (not temporary or contingent workers) working 20 hours or more per week are eligible for benefits, though eligibility for specific benefits may be determined by the division of Truist offering the position.

• Truist offers medical, dental, vision, life insurance, disability, accidental death and dismemberment, tax-preferred savings accounts, and a 401k plan to teammates.
• Teammates also receive no less than 10 days of vacation (prorated based on date of hire and by full-time or part-time status) during their first year of employment, along with 10 sick days (also prorated), and paid holidays.
• For more details on Truist’s generous benefit plans, please visit our Benefits site.
• Depending on the position and division, this job may also be eligible for Truist’s defined benefit pension plan, restricted stock units, and/or a deferred compensation plan.

Truist is an Equal Opportunity Employer that does not discriminate on the basis of race, gender, color, religion, citizenship or national origin, age, sexual orientation, gender identity, disability, veteran status, or other classification protected by law.

Truist is a Drug Free Workplace.

• EEO is the Law E-Verify IER Right to Work
• #J-18808-Ljbffr