Security Software Engineer, Open Source Frameworks - Vercel

About Vercel

Vercel is the agentic infrastructure company. We create products like Next.js, v0, and the AI SDK that help builders move from idea to production with speed, security, and exceptional developer experience. We are building the platform for the future of software, trusted by companies like OpenAI, PayPal, and Ramp.

About the Role

As a Security Software Engineer, you will focus on the security of our open-source portfolio, including Turborepo, Nuxt, Svelte/SvelteKit, SWR, Workflow, and Nitro. You will move beyond filing individual bugs to identifying systemic patterns and driving framework-level design changes that eliminate entire classes of vulnerabilities.

What You Will Do

• Hunt for vulnerability classes: Perform deep security assessments of framework internals (routing, middleware, caching, server actions, build pipelines).
• Drive root-cause fixes: Implement design changes upstream to eliminate vulnerability categories across all applications using the framework.
• Manage disclosure and CVEs: Triage security reports, coordinate embargoed fixes, and manage the CVE/CNA process.
• Run the OSS bug bounty program: Validate findings, reproduce issues, and coordinate fixes with maintainers.
• Integrate security into design: Partner with core teams during RFCs to ensure security is considered from the first draft.
• Build preventive tooling: Contribute linters, codemods, and CI checks to prevent regressions.
• Own supply chain security: Harden build, signing, and distribution processes for our OSS projects.

About You

• Hands-on experience: You have built real applications with our frameworks or have a history of reporting security issues in them.
• 4+ years in security engineering: Proven experience with hands-on open-source contributions.
• Deep technical knowledge: Strong JavaScript/TypeScript fundamentals and understanding of modern meta-framework internals (SSR/RSC, bundling, build systems).
• Pragmatic approach: Ability to balance real-world risk with community bandwidth to ship effective security improvements.
• Communication skills: Ability to explain complex vulnerabilities and design tradeoffs to maintainers and non-security engineers.

Benefits

• Competitive compensation package, including equity.
• Inclusive Healthcare Package.
• Mentorship and professional development support.
• Flexible Time Off.
• Gear and WFH budget to outfit your workspace.