Security Software Engineer, Open Source Frameworks

Overview

Security Software Engineer focused on securing Vercel’s high-leverage open source frameworks portfolio.

What you'll do

• Hunt for vulnerability classes by running deep security assessments of framework internals.
• Drive root-cause fixes with upstream design changes that eliminate vulnerability categories.
• Own vulnerability disclosure, coordinated disclosure, and CVE handling end to end.
• Run triage, validation, reproduction, and fix coordination for the open source bug bounty program.
• Partner with maintainers during RFCs and design reviews to build security into new features.
• Build preventive tooling (linters, codemods, CI checks) to catch regressions of fixed vulnerability classes.
• Own supply chain security for dependencies, releases, and published packages (build, signing, distribution).

What you'll need

• 4+ years in security engineering.
• Built real things with Turborepo, Nuxt, Svelte/SvelteKit, SWR, Workflow, or Nitro (or closely comparable projects).
• Hands-on open source contribution experience, including sending PRs.
• Strong JavaScript/TypeScript fundamentals and familiarity with how meta-frameworks work under the hood.
• Experience with structured security assessment methodology and coordinated/responsible disclosure, including embargoes and advisories.
• Ability to explain vulnerabilities and design recommendations clearly to maintainers and non-security engineers.
• Comfort operating publicly with external researchers and the open source community.

Details

• San Francisco, CA base pay range: $208,000.00 - $312,000.00.