Security Software Engineer, Open Source Frameworks

Vercel
San Francisco, New York, London, Berlin
Workplace: HybridFull timeUSD 208,000 - 312,000 annuallyFunction: Software EngineeringExperience: 4+ yearsSkills: ["Root cause focus","Clear communication","Pragmatic decision-making","Public collaboration","Open source respect"]

Own security for Vercel’s key open source frameworks by hunting systemic vulnerability classes across routing, middleware, caching, server actions/RSC boundaries, and the build pipeline. Drive root-cause framework fixes upstream, manage coordinated disclosure and CVE/CNA processes, and run the OSS bug bounty triage and validation. Partner with maintainers during RFCs, contribute preventive tooling, and strengthen supply chain security for dependency and release provenance.

Loading

Loading job details...

Preparing the role view and application actions.

FursaFursa
Vercel
Vercel
1 month ago

Security Software Engineer, Open Source Frameworks

✓ Verified Job

Canonical indexed version, validated from employer's careers page.

Source: Company careers pageValidated by: Fursa AI
Last checked: 19 hours agoStatus: Live

Job Summary

Own security for Vercel’s key open source frameworks by hunting systemic vulnerability classes across routing, middleware, caching, server actions/RSC boundaries, and the build pipeline. Drive root-cause framework fixes upstream, manage coordinated disclosure and CVE/CNA processes, and run the OSS bug bounty triage and validation. Partner with maintainers during RFCs, contribute preventive tooling, and strengthen supply chain security for dependency and release provenance.
Location: San Francisco, New York, London, Berlin
Workplace: Hybrid
Employment Type: Full time
Job Function: Software Engineering
Seniority: Mid level

Key Responsibilities

  • •Run deep security assessments of framework internals to identify systemic vulnerability classes and design patterns that create families of issues.
  • •Push upstream framework design changes that eliminate vulnerability categories across applications, rather than patching individual instances.
  • •Own vulnerability disclosure and CVE/CNA processes: triage reports, coordinate embargoed fixes, and write/publish advisories with maintainers.
  • •Operate the open source bug bounty program for the listed projects: triage and validate reports, reproduce findings, assess severity, and coordinate fixes.
  • •Contribute preventive tooling (linters, codemods, CI checks) and harden supply chain security for dependencies, releases, and published packages.

Pay and Benefits

Salary: USD 208,000 - 312,000 annually
Equity and Bonus:Equity
Perks:Health InsuranceEquityFlexible TimeRemote Work

Key Requirements

  • •4+ years in security engineering with hands-on open source contribution experience (e.g., sending PRs).
  • •Deep familiarity with Turborepo, Nuxt, Svelte/SvelteKit, SWR, Workflow, or Nitro, including how they’re used.
  • •Experience with structured security assessment methodology and coordinated/responsible disclosure (embargoes and advisories).
  • •Strong JavaScript/TypeScript fundamentals and ability to read framework internals (routing, SSR/RSC, middleware, bundling/build systems).
  • •Clear communication with maintainers, contributors, and non-security engineers, and comfort operating in public.
Experience:4+ yearsOpen sourceJavaScript frameworksNode ecosystemSecurity researchBug bounty
Skills:Root cause focusClear communicationPragmatic decision-makingPublic collaborationOpen source respect
Languages:English
Tech Stack:TurborepoNuxtSvelteSvelteKitSWRWorkflowNitroJavaScriptTypeScriptNodeRoutingSSRRSCMiddlewareCachingServer actionsBuild toolingLintersCodemodsCI checks

Company Brief

Vercel
Provides a frontend cloud platform and developer tools (including Next.js and v0) that simplify building, deploying, and scaling web and AI-native applications for developers and enterprises.
Industry: Cloud Computing
Company Size: Large (251 to 1,000 employees)
Revenue: USD 100M to 250M
Growth: Scaleup
Valuation: Unicorn (USD 1B+)
Funding: Series F
Headquarters: San Francisco, United States
Founded: 2015
Glassdoor
Glassdoor: 4.1
WebsiteLinkedInGlassdoor