Interactive Brokers Group

1 month ago

Security Engineer I

✓ Verified Job

Canonical indexed version, validated from employer's careers page.

Source: Company careers pageValidated by: Fursa AI

Last checked: 10 hours agoStatus: Live

Job Summary

Own day-to-day bug bounty program operations, including triage, severity assessment, researcher communication, and SLA-compliant payout decisions on a managed platform. Reproduce and validate vulnerabilities across web, API, mobile, and trading infrastructure, classifying risk with CVSS/OWASP and escalating critical issues with actionable context. Partner with developers to translate findings into clear remediation guidance, identify recurring vulnerability classes, and drive AppSec prevention through metrics and control improvements.

Location: Mumbai

Workplace: Hybrid

Employment Type: Full time

Job Function: Cybersecurity

Seniority: Mid level

Key Responsibilities

•Own the bug bounty program lifecycle on the managed platform, including triage, severity assessment, researcher communication, and payout decisions while maintaining SLA compliance.
•Reproduce and technically validate submitted vulnerabilities across web, API, mobile, and trading infrastructure attack surfaces.
•Classify findings using CVSS, OWASP, and business impact criteria; distinguish genuine risk and escalate critical issues into incident response workflows with sufficient context.
•Partner with developers to clarify findings, reproduce where needed, and provide fix guidance grounded in how the vulnerability works; identify what slows remediation.
•Identify recurring vulnerability classes across inbound reports and feed patterns into AppSec initiatives (e.g., SAST rule tuning, developer training, design review checklists).

Pay and Benefits

Equity and Bonus:Equity

Perks:Health InsuranceLife InsuranceAnnual BonusHybrid WorkMeal Allowance

Key Requirements

•2–5 years in application security, penetration testing, bug bounty operations, or security engineering with hands-on validation.
•Strong technical understanding of how web application vulnerabilities work (e.g., SSRF, IDOR, auth bypass, injection classes, business logic flaws, API auth failures, OAuth misconfigurations).
•Ability to independently assess exploitability from a researcher report using application trust boundaries and data flow context.
•Experience running a bug bounty or vulnerability disclosure program on a managed platform (e.g., Bugcrowd or HackerOne) with triage and researcher communication ownership.
•Familiarity with REST and GraphQL API security, OAuth 2.0 flows, and session management to validate findings beyond submitted steps.

Experience:2-5 yearsApplication securityPenetration testingBug bountyVulnerability disclosureFinancial services

Skills:Written communicationCross-functional collaborationIndependent reasoningPressure handling

Tech Stack:Bug bountyManaged platformBugcrowdHackerOneCVSSOWASPRESTGraphQLOAuth 2.0Session managementPythonBashBurp Suite ProNucleiZAPSAST

Company Brief

Interactive Brokers Group

Operates an electronic trading platform providing brokerage services for individuals and institutions across global markets, offering equities, options, futures, forex, bonds, and related clearing and custody services with advanced trading technology and low-cost executions.

Industry: Trading Platforms

Company Size: Enterprise (1,001+ employees)

Revenue: USD 1B+

Growth: Public Company

Valuation: Public Company (Market Cap in USD)

Funding: IPO / Publicly Listed

Headquarters: Greenwich, United States

Founded: 1977

Website LinkedIn

Loading job details...

Preparing the role view and application actions.

Interactive Brokers Group

1 month ago

Security Engineer I

✓ Verified Job

Canonical indexed version, validated from employer's careers page.

Source: Company careers pageValidated by: Fursa AI

Last checked: 10 hours agoStatus: Live

Job Summary

Location: Mumbai

Workplace: Hybrid

Employment Type: Full time

Job Function: Cybersecurity

Seniority: Mid level

Key Responsibilities

•Own the bug bounty program lifecycle on the managed platform, including triage, severity assessment, researcher communication, and payout decisions while maintaining SLA compliance.
•Reproduce and technically validate submitted vulnerabilities across web, API, mobile, and trading infrastructure attack surfaces.
•Classify findings using CVSS, OWASP, and business impact criteria; distinguish genuine risk and escalate critical issues into incident response workflows with sufficient context.
•Partner with developers to clarify findings, reproduce where needed, and provide fix guidance grounded in how the vulnerability works; identify what slows remediation.
•Identify recurring vulnerability classes across inbound reports and feed patterns into AppSec initiatives (e.g., SAST rule tuning, developer training, design review checklists).

Pay and Benefits

Equity and Bonus:Equity

Perks:Health InsuranceLife InsuranceAnnual BonusHybrid WorkMeal Allowance

Key Requirements

•2–5 years in application security, penetration testing, bug bounty operations, or security engineering with hands-on validation.
•Strong technical understanding of how web application vulnerabilities work (e.g., SSRF, IDOR, auth bypass, injection classes, business logic flaws, API auth failures, OAuth misconfigurations).
•Ability to independently assess exploitability from a researcher report using application trust boundaries and data flow context.
•Experience running a bug bounty or vulnerability disclosure program on a managed platform (e.g., Bugcrowd or HackerOne) with triage and researcher communication ownership.
•Familiarity with REST and GraphQL API security, OAuth 2.0 flows, and session management to validate findings beyond submitted steps.

Experience:2-5 yearsApplication securityPenetration testingBug bountyVulnerability disclosureFinancial services

Skills:Written communicationCross-functional collaborationIndependent reasoningPressure handling

Tech Stack:Bug bountyManaged platformBugcrowdHackerOneCVSSOWASPRESTGraphQLOAuth 2.0Session managementPythonBashBurp Suite ProNucleiZAPSAST

Company Brief

Interactive Brokers Group

Industry: Trading Platforms

Company Size: Enterprise (1,001+ employees)

Revenue: USD 1B+

Growth: Public Company

Valuation: Public Company (Market Cap in USD)

Funding: IPO / Publicly Listed

Headquarters: Greenwich, United States

Founded: 1977

Website LinkedIn