Skip to content
CertGPS
Career path

From Bug Bounty to a Security Job: Disclosed Reports as a Portfolio, and the Exams That Back Them

For bug bounty hunters moving to a salaried role: what HackerOne and Bugcrowd let you disclose, how reputation is scored, and which report-graded exams fit.

LT
Lisa Thompson
Security Training Director
Published
Updated
Read time
5 min
On this page

Related certifications

Topics

From Bug Bounty to a Security Job: Disclosed Reports as a Portfolio, and the Exams That Back Them

A disclosed bounty report lets a hiring manager assess your methods as well as your results. On both HackerOne and Bugcrowd a report goes public only when the program agrees, and some programs never will, so the portfolio you can show is smaller than the work you've done. Plan for that while you're still hunting, and fill the gaps with exams that grade a written report.

What the platforms record about you

HackerOne awards or deducts reputation based on report state, with exceptions for some reports. A triaged or resolved report earns 7 reputation points, an informative one earns nothing, a report closed as not applicable generally costs 5, and spam costs 10. Self-closed not-applicable reports are an exception, at zero. Bounties add more, scaled by how the award compares with the program's usual payouts. From those points HackerOne derives two averages. Signal is your average reputation per report, on a scale from −10 to 7, and HackerOne calls it "an aggregate representation of report validity". Impact is your average reputation per bounty, a proxy for severity. Signal is calculated only after more than three closed reports and excludes self-closed, duplicate and informative reports; Impact needs more than three bounties.

Signal is the figure to put on a résumé next to your report count, because it answers the question an employer will ask first: how often were you right? A high report count with a low signal says you filed a lot of noise. HackerOne's Hacktivity feed shows activity on public programs, with disclosed reports readable in full and undisclosed ones shown with titles redacted.

Bugcrowd's equivalent feed is CrowdStream. When a program approves a disclosure, the report appears there along with your username and the avatar from your profile.

Disclosure rules decide what you can show

HackerOne requires formal approval from the program before you disclose anything. Its documentation says that silence or a refusal "does not constitute approval", and that disclosing without approval, or signalling that you intend to, breaks its Code of Conduct. There is one default in your favor. On programs that have disclosure switched on, a resolved report with no response moves to disclosure within 30 days. Either side can choose full disclosure, which shows the report and its whole timeline, or limited disclosure, which shows only the summary and timeline.

Bugcrowd runs three policies. Coordinated Disclosure lets researchers publish mutually agreed details once a flaw is fixed, and Bugcrowd recommends it for new public programs. Nondisclosure, the default for its On-Demand bounties and Pen Test MAX engagements, means no submission may ever be published. Custom policies, set by the program, override the platform's terms. Private programs are stricter still: you may not tell anyone outside Bugcrowd and the program owner that they exist.

That leaves two kinds of evidence. Disclosed reports can be linked and quoted. For undisclosed work, ask the program what you may describe in interviews or a portfolio. Anonymizing a target does not itself permit disclosure; use your own lab examples if the program has not approved a description. Start steering some of your hunting toward programs that disclose now, because the reports you can link will carry your application.

On May 19, 2022 the US Department of Justice told federal prosecutors to decline Computer Fraud and Abuse Act cases where the conduct was good-faith security research. That means access solely to test, investigate or fix a flaw, done in a way designed to avoid harm. The Justice Manual adds that the policy creates no right a defendant can enforce, and it doesn't bind state prosecutors or the companies you test.

Bounty hunters rely on program terms instead. Bugcrowd marks programs that offer full or partial safe harbor under the disclose.io framework, and Bugcrowd recommends an exhaustive list of in-scope targets for full safe harbor, so protection stops at the scope line. In a salaried testing role the scope comes from a client contract and your employer's rules of engagement. Be ready to explain in an interview how you've kept to scope, with an example.

Where bounty skills fit, and what they leave out

The nearest NICE Framework work role is Vulnerability Analysis (PD-WRL-007). Its tasks include "identify vulnerabilities", where a strong hunter already excels, and also "recommend vulnerability remediation strategies" and "develop cybersecurity risk profiles", which bounty work rarely asks for. Programs pay for the finding. Employers also want the fix explained in terms a development team can schedule, and an honest rating of how much the flaw matters to the business.

Two destinations use bounty skills most directly: web application testing at a consultancy, and product security or AppSec roles at companies that run their own programs, where you might triage other hunters' reports. Our penetration tester career guide covers the consultancy route, and the security researcher path covers jobs that keep you finding new vulnerabilities.

One gap to check early: ISC2's experience rules for SSCP and CISSP count full-time work, part-time work of 20 to 34 hours a week, and internships confirmed on letterhead. The page doesn't mention freelance or bounty work. Ask ISC2 before you count bounty years toward either credential.

Exams that grade the same skills

Choose exams that make you write, because a report is what bounty hunting and testing jobs have in common.

OSWE suits web hunters who read source code. OffSec's exam gives you 47 hours and 45 minutes to break several applications by reading their code, then requires one script per target that runs the full attack unattended, plus a report. The $1,749 bundle includes 90 days of the WEB-300 course, and the credential doesn't expire.

OSCP matters if consultancies are your target, because their engagements reach past web applications into networks and Active Directory. The exam runs 23 hours and 45 minutes, with another 24 hours to upload the report, and costs $1,749 with 90 days of PEN-200.

For black-box web testing, INE's eWPT is an auto-graded practical lab. You need an INE Premium subscription to buy the voucher, and the bundle with three months of Premium costs $599. GIAC's GWAPT ($999) includes hands-on CyberLive items and is the one to take if an employer pays for SANS training. Outside our catalog, PortSwigger's Burp Suite Certified Practitioner gives you four hours to compromise two applications in three stages each. It requires an active Burp Suite Professional subscription and is valid for five years.

Our view

A strong signal and a few disclosed reports are good evidence that you can find flaws. In our view the weak point in most bounty hunters' applications is the other half of the job, remediation and risk. We'd spend the last stretch of full-time hunting on two things: disclosure requests on every resolved report where the program allows it, and one report-graded exam, OSWE for web specialists or OSCP for anyone heading to a consultancy. Write the exam report the way you'd write it for a client, with the fix and its priority, since that's the part bounty work never made you practise.

Sources