Program Manager (Vulnerability Discovery)
About the role
Neutron is looking for a Programme Manager to lead our Crowdsourced Vulnerability Discovery Programmes (CVDP) — a suite of three programmes that help government agencies find and fix security vulnerabilities: the Government Bug Bounty Programme (GBBP), the Vulnerability Rewards Programme (VRP), and the Vulnerability Disclosure Programme (VDP). You'll own the planning, execution, and monitoring of these programmes end to end, working closely with government agencies, the security researcher community, and our appointed bug bounty vendor to keep every programme running smoothly. It's a role for someone who enjoys bringing structure to complex, multi-stakeholder work and who's excited to use new tools — including AI — to make things run better.
Key responsibilities
Plan, schedule, and oversee GBBP, VRP, and VDP programme runs
Coordinate with government agencies on programme participation, scoping, and timelines — following up to ensure required data and documentation are submitted on time
Manage the end-to-end vendor relationship, including contract administration, performance monitoring, and issue escalation — covering preparation of each bug bounty run and researcher onboarding (recruitment, vetting, and test account provisioning)
Support the triage team with reporting, and coordinate with agencies to resolve any disputes
Support procurement and tender exercises, including drafting requirement specifications and evaluating vendor proposals
Prepare programme reports, dashboards, and management updates for stakeholders
Drive stakeholder communications and outreach, such as agency briefings, to raise awareness and grow participation
Proactively identify and lead process improvements across CVDP operations — including using AI-assisted development and approved GovTech platforms to automate workflows, improve reporting, and boost efficiency
About you
At least 5 years of experience managing IT or technology programmes/projects (experience with a bug bounty, vulnerability disclosure, or cybersecurity programme is a strong plus)
Strong project management skills to plan, execute, and monitor programme operations
Good written and verbal communication in English, with the ability to explain technical findings to non-technical stakeholders
Experience managing vendors or contracts, including tracking deliverables and service levels
Comfortable working with data to track metrics and produce management reports
A track record of proposing and implementing process improvements, including using AI-assisted development or approved digital platforms to streamline operations
Singapore Citizen or Permanent Resident, as the role involves handling government systems and data requiring security clearance eligibility
PMP, CITPM, or an equivalent project management certification (nice to have)
Familiarity with vulnerability management, penetration testing, or bug bounty concepts (nice to have)
Experience working with or within the public sector (nice to have)