Vercel

5 days ago

Security Software Engineer, Open Source Frameworks

✓ Verified Job

Canonical indexed version, validated from employer's careers page.

Source: Company careers pageValidated by: Fursa AI

Last checked: 11 hours agoStatus: Live

Job Summary

Own security for Vercel’s key open source frameworks by hunting systemic vulnerability classes across routing, middleware, caching, server actions/RSC boundaries, and the build pipeline. Drive root-cause framework fixes upstream, manage coordinated disclosure and CVE/CNA processes, and run the OSS bug bounty triage and validation. Partner with maintainers during RFCs, contribute preventive tooling, and strengthen supply chain security for dependency and release provenance.

Location: San Francisco, New York, London, Berlin

Workplace: Hybrid

Employment Type: Full time

Job Function: Software Engineering

Seniority: Mid level

Key Responsibilities

•Run deep security assessments of framework internals to identify systemic vulnerability classes and design patterns that create families of issues.
•Push upstream framework design changes that eliminate vulnerability categories across applications, rather than patching individual instances.
•Own vulnerability disclosure and CVE/CNA processes: triage reports, coordinate embargoed fixes, and write/publish advisories with maintainers.
•Operate the open source bug bounty program for the listed projects: triage and validate reports, reproduce findings, assess severity, and coordinate fixes.
•Contribute preventive tooling (linters, codemods, CI checks) and harden supply chain security for dependencies, releases, and published packages.

Pay and Benefits

Salary: USD 208,000 - 312,000 annually

Equity and Bonus:Equity

Perks:Health InsuranceEquityFlexible TimeRemote Work

Key Requirements

•4+ years in security engineering with hands-on open source contribution experience (e.g., sending PRs).
•Deep familiarity with Turborepo, Nuxt, Svelte/SvelteKit, SWR, Workflow, or Nitro, including how they’re used.
•Experience with structured security assessment methodology and coordinated/responsible disclosure (embargoes and advisories).
•Strong JavaScript/TypeScript fundamentals and ability to read framework internals (routing, SSR/RSC, middleware, bundling/build systems).
•Clear communication with maintainers, contributors, and non-security engineers, and comfort operating in public.

Experience:4+ yearsOpen sourceJavaScript frameworksNode ecosystemSecurity researchBug bounty

Skills:Root cause focusClear communicationPragmatic decision-makingPublic collaborationOpen source respect

Languages:English

Tech Stack:TurborepoNuxtSvelteSvelteKitSWRWorkflowNitroJavaScriptTypeScriptNodeRoutingSSRRSCMiddlewareCachingServer actionsBuild toolingLintersCodemodsCI checks

Company Brief

Vercel

Provides a frontend cloud platform and developer tools (including Next.js and v0) that simplify building, deploying, and scaling web and AI-native applications for developers and enterprises.

Industry: Cloud Computing

Company Size: Large (251 to 1,000 employees)

Revenue: USD 100M to 250M

Growth: Scaleup

Valuation: Unicorn (USD 1B+)

Funding: Series F

Headquarters: San Francisco, United States

Founded: 2015

Glassdoor: 4.1

Website LinkedIn Glassdoor

Loading job details...

Preparing the role view and application actions.

Vercel

5 days ago

Security Software Engineer, Open Source Frameworks

✓ Verified Job

Canonical indexed version, validated from employer's careers page.

Source: Company careers pageValidated by: Fursa AI

Last checked: 11 hours agoStatus: Live

Job Summary

Location: San Francisco, New York, London, Berlin

Workplace: Hybrid

Employment Type: Full time

Job Function: Software Engineering

Seniority: Mid level

Key Responsibilities

•Run deep security assessments of framework internals to identify systemic vulnerability classes and design patterns that create families of issues.
•Push upstream framework design changes that eliminate vulnerability categories across applications, rather than patching individual instances.
•Own vulnerability disclosure and CVE/CNA processes: triage reports, coordinate embargoed fixes, and write/publish advisories with maintainers.
•Operate the open source bug bounty program for the listed projects: triage and validate reports, reproduce findings, assess severity, and coordinate fixes.
•Contribute preventive tooling (linters, codemods, CI checks) and harden supply chain security for dependencies, releases, and published packages.

Pay and Benefits

Salary: USD 208,000 - 312,000 annually

Equity and Bonus:Equity

Perks:Health InsuranceEquityFlexible TimeRemote Work

Key Requirements

•4+ years in security engineering with hands-on open source contribution experience (e.g., sending PRs).
•Deep familiarity with Turborepo, Nuxt, Svelte/SvelteKit, SWR, Workflow, or Nitro, including how they’re used.
•Experience with structured security assessment methodology and coordinated/responsible disclosure (embargoes and advisories).
•Strong JavaScript/TypeScript fundamentals and ability to read framework internals (routing, SSR/RSC, middleware, bundling/build systems).
•Clear communication with maintainers, contributors, and non-security engineers, and comfort operating in public.

Experience:4+ yearsOpen sourceJavaScript frameworksNode ecosystemSecurity researchBug bounty

Skills:Root cause focusClear communicationPragmatic decision-makingPublic collaborationOpen source respect

Languages:English

Tech Stack:TurborepoNuxtSvelteSvelteKitSWRWorkflowNitroJavaScriptTypeScriptNodeRoutingSSRRSCMiddlewareCachingServer actionsBuild toolingLintersCodemodsCI checks

Company Brief

Vercel

Provides a frontend cloud platform and developer tools (including Next.js and v0) that simplify building, deploying, and scaling web and AI-native applications for developers and enterprises.

Industry: Cloud Computing

Company Size: Large (251 to 1,000 employees)

Revenue: USD 100M to 250M

Growth: Scaleup

Valuation: Unicorn (USD 1B+)

Funding: Series F

Headquarters: San Francisco, United States

Founded: 2015

Glassdoor: 4.1

Website LinkedIn Glassdoor