Bug Bounty Hunter.

An independent security researcher who finds and reports vulnerabilities to vendors through bug-bounty or coordinated-disclosure programs, in exchange for monetary rewards and recognition. It belongs to the Roles & Careers category of cybersecurity.

An independent security researcher who finds and reports vulnerabilities to vendors through bug-bounty or coordinated-disclosure programs, in exchange for monetary rewards and recognition.

A bug bounty hunter is an independent security researcher who finds vulnerabilities in scope-defined targets and reports them through bug-bounty programs (HackerOne, Bugcrowd, Intigriti, YesWeHack, vendor-run) or coordinated-disclosure channels. Income is per-bug and skewed heavily toward critical findings; top researchers earn six- or seven-figure annual payouts and live-hacking event prizes. Most hunters operate as full-time freelancers or alongside a day job in offensive security, and many cross over to enterprise pentesting or vendor application-security roles. There is no fixed career path; reputation is built on a public stream of valid reports, CVE attributions, and write-ups. Strict legal-safe-harbor scope, deduplication, and reporting quality are critical for sustained earnings.

Defences for Bug Bounty Hunter typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Bug hunter, Bounty hunter (security).