> Markdown version of [/jobs/ext/3231938-security-triage-analyst](https://www.wearedevelopers.com/jobs/ext/3231938-security-triage-analyst). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md).

---

# Security Triage Analyst

- **Company:** Verda ltd
- **Location:** London, UK
- **Experience:** Expert
- **Contract:** Permanent contract
- **Skills:** Application Programming Interfaces (APIs), Artificial Intelligence, Business Logic, Software System Penetration Testing, User Authentication, Bash Shell, Burp Suite, Cloud Computing Security, Cyber Security, Cross-Origin Resource Sharing (Ajax Programming), Customer Data Management, Programming Tools, Identity and Access Management, Virtual Private Networks (VPN), Python (Programming Language), CURL, Cloud Services, Screenshots, Web Applications, Software Security, Rate Limiting, Kubernetes, Bug Reporting, Hardware Infrastructure
- **Published:** September 14, 2026
- **Apply:** https://www.indeed.com/viewjob?jk=46772d4f0c6b00e6

## About the Role

* 5+ years of previous experience in vulnerability triage, application security, penetration testing, security operations, or a closely related security role
 * Ability to understand and validate technical vulnerability reports, including incomplete, unclear, automated, or poorly written ones
 * Practical knowledge of web application and API security: authentication, authorisation, access control, CORS (Cross-Origin Resource Sharing), rate limiting, SSRF (Server-Side Request Forgery), injection issues, file handling, and business logic flaws
 * Enough infrastructure and cloud security depth to reason about network exposure, internal services, storage, identity, Kubernetes, management interfaces, and multi-tenant environments
 * Ability to reproduce findings safely using tools such as Burp Suite, curl, browser developer tools, API clients, logs, and basic scripting
 * Sound judgement on severity and impact using CVSS or a comparable model - telling the finding that matters from the one that only looks serious at first glance
 * Strong attention to detail when comparing duplicates, checking evidence, and reviewing reproduction steps
 * Professional handling of external researchers, including unclear, automated, duplicated, disputed, or appealed reports
 * Comfortable where there is no runbook yet, with the curiosity to learn an environment most security people have not seen

## Description

Vulnerability triage is often treated as queue work: read the report, check the scope, set a severity, move it on. We are building this role differently. As Security Triage Analyst you own the first layer of judgement on every report that reaches Verda - what is real, what matters, what needs more evidence, and what happens next - reproducing findings where it is safe to, assessing impact, and writing them up so engineers can act.

The environment is unusual: Verda runs multi-tenant GPU infrastructure, customer-facing cloud services, APIs, and management planes, so a report that looks routine elsewhere can matter more here because of tenant isolation, customer impact, or infrastructure access.

You will work closely with Security, Engineering, Infrastructure, external triage partners, and researchers, and you will help improve how vulnerability handling works as the volume grows., * Review incoming reports from external researchers, bug bounty and vulnerability disclosure programmes, penetration tests, AI-assisted testing platforms, and internal security assessments

 * Validate findings: check the affected asset, reproduce the issue where safe and appropriate, and confirm whether the described impact is realistic in Verda's environment
 * Classify findings as valid vulnerability, duplicate, false positive, expected behaviour, accepted risk, out of scope, or needs more information, and make each decision understandable and defensible
 * Assess severity and impact using CVSS (Common Vulnerability Scoring System) alongside Verda's own context: multi-tenancy, customer data, infrastructure access, and privilege boundaries
 * Work with the offensive security team and security engineers to separate real bugs from expected product behaviour, standard cloud configuration, intentionally public assets, and findings outside Verda's threat model
 * Communicate with researchers, external triage teams, and vendors professionally, including asking for clarification, explaining decisions, and handling appeals
 * Turn valid findings into internal tickets engineering teams can act on: what is affected, how it was reproduced, the impact, the evidence, and the expected next step
 * Keep the queue moving so high and critical reports surface quickly, duplicates are linked cleanly, and unclear reports always have a clear next action
 * Improve how we run the programme as volume grows - report templates, researcher guidance, severity rules, duplication logic, workflows, and metrics on volume, time to triage, and time to resolution - treating duplicates and false positives as signal about where it needs work
 * Handle sensitive material carefully, since reports can contain customer-impacting detail, internal infrastructure information, credentials, screenshots, logs, and exploit chains, * Experience managing or operating a bug bounty or vulnerability disclosure platform such as YesWeHack, HackerOne, or Bugcrowd, including researcher reward models and severity appeals
 * Background in cloud service providers, hosting, infrastructure, or multi-tenant platforms
 * Familiarity with Kubernetes, object storage, IAM (Identity and Access Management), VPNs (Virtual Private Networks), APIs, and customer-facing cloud consoles
 * Basic Python, Bash, or other scripting for reproducing issues and automating repetitive triage tasks
 * Experience with AI-assisted security testing, or reviewing AI-generated vulnerability reports
 * Relevant certifications