Product Security Engineer - Vercel

About Vercel

Vercel is the agentic infrastructure company. We create products like Next.js, v0, and the AI SDK that help builders move from idea to production with speed, security, and exceptional developer experience. We are building the platform for the next generation of agent-operated software.

About the Role

We are looking for a Product Security Engineer to build systems that automate security at scale. Traditional manual triage doesn't scale for Vercel; we need to build tooling that triages, validates, and remediates security findings continuously. You will focus on agentic analysis, root-cause identification, and building security testing capabilities that our customers can use directly on our platform.

What You Will Do

• Automated Triage: Design systems to automatically assess the validity, severity, and reproducibility of external security reports.
• Agentic Analysis: Build LLM/agent-based reasoning to validate business logic, auth, and design-level findings.
• Root Cause Analysis: Trace findings back to their source to prevent recurring vulnerability classes.
• Automated Remediation: Design systems that propose or open fixes for well-understood vulnerability classes.
• Tooling Evolution: Replace traditional manual pentesting processes with agent-driven automation.
• Program Management: Own the researcher-facing side of our bug bounty program.
• Customer Security: Extend internal security tooling into customer-facing testing capabilities.

About You

• Builder First: Strong software engineering background is prioritized over manual penetration testing experience.
• Systems Thinker: You focus on scaling security processes to handle thousands of reports.
• AI/Agentic Interest: You have a clear perspective on the current capabilities and limitations of LLMs in security.
• Tech Stack: Proficiency in JavaScript/TypeScript, Node.js, and modern web frameworks (Next.js/React).

Bonus Points

• Experience building security automation for engineering organizations.
• Background in managing bug bounty or vulnerability disclosure programs.
• Experience securing multi-tenant platforms.
• Relevant certifications (OSCP, OSWE, CISSP).

Benefits

• Competitive compensation package, including equity.
• Inclusive Healthcare Package.
• Mentorship and professional development support.
• Flexible Time Off.
• Gear and WFH budget to outfit your workspace.