Note: The job is a remote job and is open to candidates in USA. RunSybil is building an AI-driven penetration testing platform that helps defenders discover vulnerabilities before exploitation. The Security Analyst will assess, validate, reproduce, and rate web application vulnerabilities, then produce clear customer-facing reports and remediation guidance while identifying patterns and improvement opportunities for the platform.

Responsibilities

• Assess and validate web application vulnerabilities across a range of targets and confirm exploitability and scope
• Reproduce findings hands-on using tools like Burp Suite
• Rate severity accurately using established frameworks such as CVSS and OWASP
• Write clear, accurate, customer-facing finding descriptions and remediation guidance that security practitioners trust and developers can act on
• Maintain consistent standards across a high volume of findings
• Surface patterns, edge cases, and unusual behaviors to the broader team
• Identify patterns across findings and share feedback on where and how Sybil can improve

Skills

• 2 or more years of hands-on experience with web application vulnerabilities through bug bounty, penetration testing, application security, or a similar role
• Solid, practical understanding of OWASP Top 10 and common web vulnerability classes: you have actually found and confirmed these, not just read about them
• Experience reproducing and validating findings manually, including in ambiguous or noisy environments
• Comfort with tools like Burp Suite, browser developer tools, or similar for hands-on verification
• Strong written communication: you can describe a vulnerability, its impact, and how to fix it in plain language
• Attention to detail and consistency: you apply the same standard to the hundredth finding that you applied to the first
• Self-direction: you manage your own work without needing someone to structure your day
• Remote (US)

Benefits

• Meaningful equity

Company Overview