EU remote
Bug Bounty Hunter (M/F)
About this role
We are looking for a permanent Bug Bounty Hunter (M/F), based in Montpellier, Valbonne, or working fully remotely. What we can achieve together: Septeo's Red Team has transformed the way it operates. Vulnerability research no longer relies on occasional, manually executed campaigns, but on agentic offensive workflows : chains of agents that continuously explore the exposed attack surface, test applications, analyse code and verify fixes.
This shift changes where the value lies: what matters today is no longer the number of testing hours, but the quality of the tools and capabilities designed, together with the judgement used to steer them. Reporting to the Head of Offensive Security R&D, your role will cover two core areas: building, stabilising and maintaining vulnerability detection tools and processes; and working closely with the Group’s Product Owners, DTOs, developers and CISOs to share findings, support remediation and strengthen security practices.
Your work will be built around three systems that currently structure our offensive security capabilities: An AI-powered internal EASM platform: continuous discovery of the exposed attack surface, asset qualification and ownership mapping, and identification of attack chains. Agentic SAST : continuous code analysis and repository-specific remediation proposals, rather than generic recommendations. A vulnerability lifecycle management platform: from initial finding to automated retesting and management-level reporting.
You will operate, strengthen and continuously improve these systems. From day one, you will also identify and design what is missing: you will not simply execute a roadmap, but help shape it. Your day-to-day responsibilities: Design, develop and enhance offensive tools and workflows, including their architecture, scope, guardrails and stop conditions. Deploy, stabilise and maintain them with a Dev/DevOps mindset, covering pipelines, CI/CD, monitoring and continuous reliability improvements.
Operate them on a daily basis: schedule, launch and monitor workflows; diagnose agent drift; triage false positives; and restore systems after incidents. Prototype quickly, measure tangible value and decide what should be industrialised or discontinued. Work regularly with the Group’s Product Owners, DTOs, developers and CISOs to qualify vulnerabilities, turn findings into actionable information and track remediation.