Lead Product Security Engineer: Threat Modeling & Secure SDLC

Jobtailor; California (MO); On-site; USD 140,000 - 190,000; Full time

Job summary

Vercel is seeking a Product Security professional to collaborate with engineering and product teams to threat-model features, review secure code, and manage our security tooling and bug bounty program.

The role focuses on securing applications built with Next.js and Node.js, extending security practices across the SDLC, and guiding multiple teams in best security practices to protect users and data.

Qualifications

• 5+ years in a Product Security role or related field securing web products/services.
• Strong familiarity with JavaScript/TypeScript and Node.js runtime security.
• Experience with threat modeling and architectural risk analysis for complex products.
• Hands-on with product security tooling (SAST, DAST, dependency scanners, CI/CD security integration).
• Knowledge of open-source security best practices.
• Exposure to bug bounty programs or vulnerability disclosure processes.
• Understanding of cloud architecture and serverless environments from security perspective.
• Ability to drive security initiatives and influence engineering teams.

Responsibilities

• Partner with engineering and product teams to perform threat modeling for new and existing features.
• Conduct secure code reviews and security assessments on products and services built with Next.js, Node.js, and our serverless backend.
• Oversee open-source security efforts.
• Evaluate, select, and integrate security tools into our SDLC.
• Own and expand bug bounty program.
• Lead and contribute to security projects spanning multiple teams.
• Collaborate with customer success and product marketing on security initiatives affecting users.

Skills

Threat modeling

JavaScript/TypeScript security

Node.js security

SAST

DAST

Dependency scanners

CI/CD security

Cloud/serverless security

Architectural risk analysis

Bug bounty / vulnerability disclosure

Influence engineering teams

Tools

SAST

DAST

Dependency scanners

CI/CD security

Job description

Vercel is seeking a Product Security professional to collaborate with engineering and product teams to threat-model features, review secure code, and manage our security tooling and bug bounty program.

The role focuses on securing applications built with Next.js and Node.js, extending security practices across the SDLC, and guiding multiple teams in best security practices to protect users and data.