Home

Resume

Matthew Crum · Security Analyst, Application Security · Greater Chicago Area · Email · LinkedIn · GitHub

Summary

Application security analyst with three years of hands-on vulnerability triage in a large-scale bug bounty environment: 6,700+ reports validated across web, API, mobile, cloud, host, and LLM targets. Skilled at turning complex findings into clear, actionable guidance for technical and non-technical audiences. Experienced in training analysts and improving triage workflows through scripting and AI-assisted automation.

Technical Skills

Application Security
Vulnerability validation and triage, severity and impact assessment, OWASP Top 10, web/API/mobile/cloud security, LLM application security
AI-Assisted Automation
LLM agents (Claude), prompt and workflow design, human-in-the-loop systems
Tools
Burp Suite, Python, Bash, Linux CLI
Professional
Analyst training, technical documentation, presentations, stakeholder communication

Professional Experience

Key results (last two years)

Synack · Remote · Aug 2023 - Present

  • Triaged 5,000+ vulnerability reports and adjudicated $3.3M in researcher payouts, ranking #4 in output on a team of 10-12 analysts.
  • Triaged 675+ critical-severity findings, including RCE, SQL injection, account takeover, and authentication bypass.
  • 96.8% of validated findings accepted by customers; 93.5% of triage decisions upheld in peer review.
  • Trained 10+ new analysts: led core training sessions and reviewed their triage decisions until they were cleared for independent adjudication.

Security Analyst

Synack · Remote · Mar 2026 - Present

  • Serve as an escalation point for complex technical and operational issues; deliver internal technical presentations on complex security concepts.
  • Review and arbitrate severity and payout decisions for high-impact submissions, weighing technical validity, business risk, and platform policy.
  • Designed and built an AI-assisted triage tool using Claude that checks submissions for scope, validity, and duplicates and generates analyst notes and draft researcher communications to support my human-reviewed triage workflow.

Associate Security Analyst

Synack · Remote · Dec 2023 - Mar 2026

  • Triaged and validated vulnerability submissions across web, API, mobile, cloud, host, and LLM targets, with a focus on access control/IDOR, XSS, and SQL injection (50%+ of volume).
  • Wrote remediation guidance and explained findings to technical and non-technical stakeholders.
  • Built and maintained internal workflow tooling and Python automation scripts using API-driven processes.
  • Served as backup for the support team, resolving researcher disputes about report outcomes, including reversing decisions when warranted.
  • Assisted with patch verification, responsible disclosure workflows, and vulnerability documentation.

Security Analyst Intern

Synack · Remote · Aug 2023 - Dec 2023

  • Validated vulnerability reports alongside senior analysts, building hands-on web app security experience.

Cybersecurity Mentor

Fullstack Academy · Remote · Nov 2022 - May 2023

  • Taught and mentored cybersecurity students remotely, maintaining a 9.5/10 average satisfaction score.

Education & Certifications

Projects