Crowdsourced security platform for bug bounty, pentesting and vulnerability disclosure
Bugcrowd connects organizations with vetted hackers through a platform for bug bounties, penetration testing and vulnerability disclosure. Hiring tilts heavily toward security operations, centered on triage and validation of incoming submissions, which suggests that processing report volume is the core operational bottleneck. A stack spanning AWS Bedrock, OpenAI and Anthropic alongside FedRAMP points to AI-assisted triage and a push into regulated public-sector buyers.
Bugcrowd is a privately held security company founded in 2012 and headquartered in San Francisco, California, with 201–500 employees. It runs crowdsourced security programs, including bug bounties, penetration testing, application and mobile security testing, and vulnerability disclosure, pairing customers with trusted researchers through an AI-enabled platform. Engineering runs on Go, Ruby, Python, Rust, TypeScript and React across AWS, GCP and Azure with Kubernetes. Go-to-market tooling includes Salesforce, Gainsight and 6sense. The team hires across the United States, United Kingdom, Brazil, Costa Rica, India and Australia.
Bugcrowd uses Go, Ruby, Python, Rust, TypeScript, React and Next.js on AWS, GCP and Azure with Kubernetes and Docker. It also uses Splunk, AWS Bedrock, OpenAI and Anthropic, plus Salesforce and Gainsight.
Yes. Security is Bugcrowd's dominant hiring area, focused on triage and validation of bug bounty submissions and on incident response. Mostly mid and senior roles, with smaller openings in sales, engineering, product and support.
Bugcrowd hires in the United States, United Kingdom, Brazil, Costa Rica, India and Australia. Its headquarters is in San Francisco, California.
Other companies in the same industry, closest in size
Bugcrowd's technology stack, projects, and hiring signals are inferred from public hiring and company data — career pages, public listings, and company web presence — then clustered and de-duplicated. Figures are estimates that refresh over time. Read our full methodology →
This is not an official vendor or customer list. It is a technology-adoption signal inferred from public data, intended for B2B research.