Senior Corporate Security Operations Analyst

Mastercard is seeking a Senior Vulnerability Analyst to manage the Bug Bounty Program and perform advanced application security testing across web, mobile, and API environments.

Responsibilities:

• Manage the Bug Bounty Program, including vulnerability intake, validation, triage, and researcher engagement.
• Conduct penetration testing of web, mobile, and API-based applications.
• Assess risk, prioritize findings, and provide remediation guidance.
• Partner with product and engineering teams to drive timely remediation and validate fixes.
• Develop reporting and metrics to measure program effectiveness and communicate risk.

Requirements:

• At least 3 years of experience in application security and penetration testing.
• Strong knowledge of web, mobile, and API security, including OWASP Top 10 risks.
• Hands-on experience with tools such as Burp Suite, OWASP ZAP, or similar testing platforms.
• Ability to assess vulnerabilities, communicate risk, and provide actionable remediation guidance.
• Strong stakeholder management, analytical, and problem-solving skills.
• Experience with bug bounty or vulnerability disclosure programs and relevant security certifications is a plus.

Corporate Security Responsibility: All activities involving access to Mastercard assets, information, and networks come with an inherent risk to the organization. Therefore, it is expected that every person working for, or on behalf of, Mastercard is responsible for information security and must:

• Abide by Mastercard’s security policies and practices;
• Ensure the confidentiality and integrity of the information being accessed;
• Report any suspected information security violation or breach,
• Complete all periodic mandatory security trainings in accordance with Mastercard’s guidelines.