Open Source Security Engineer for Frameworks

Empleora; Colombia; A distancia; COP 646.364.000 - 969.546.000; Jornada completa

Ventajas ofrecidas por este puesto de trabajo

Equity included

Inclusive healthcare

Mentorship & events

Flexible time off

WFH budget

Descripción de la vacante

Vercel seeks a security engineer to hunt vulnerability classes across Turborepo, Nuxt, Svelte/SvelteKit, SWR, Workflow, and Nitro, and to drive framework‑level fixes. You will own how disclosure and CVEs are handled and run the OSS bug bounty program with maintainers and researchers.

You should have 4+ years in security engineering, strong JS/TS skills, and a track record of open source contributions. This role emphasizes pragmatic, design‑level security improvements and collaboration with the

Formación

• 4+ years in security engineering.
• Hands-on open source contribution experience.
• Strong JavaScript/TypeScript fundamentals.
• Ability to read framework internals and security patterns.

Responsabilidades

• Run deep security assessments of framework internals to find systemic patterns.
• Push design changes that eliminate whole classes of vulnerabilities.
• Coordinate disclosure and CVEs, write advisories and manage processes.
• Own OSS bug bounty triage, validation, and fix coordination.
• Bake security into design during RFCs and design reviews.
• Build preventive tooling: linters, codemods, CI checks.
• Harden supply chain security for dependencies and packages.
• Engage with maintainers and researchers to improve security publicly.

Conocimientos

Security engineering

Open source contribution

JavaScript/TypeScript

Framework internals

Coordinated disclosure

Herramientas

Sigstore

SLSA

Dependency scanning

Descripción del empleo

Vercel seeks a security engineer to hunt vulnerability classes across Turborepo, Nuxt, Svelte/SvelteKit, SWR, Workflow, and Nitro, and to drive framework‑level fixes. You will own how disclosure and CVEs are handled and run the OSS bug bounty program with maintainers and researchers.

You should have 4+ years in security engineering, strong JS/TS skills, and a track record of open source contributions. This role emphasizes pragmatic, design‑level security improvements and collaboration with the