Open-Source Security Engineer for JS Frameworks

United States Digital Space LLC; San Francisco (CA); Hybrid; USD 155,000 - 190,000; Full time

Benefits offered by this job

Competitive compensation

Equity

Healthcare package

Job summary

United States Digital Space LLC in San Francisco seeks a security engineer to defend open source projects like Turborepo, Nuxt, SvelteKit, SWR, and Nitro. You will hunt vulnerability classes, design framework-level fixes, and own CVE coordination with the OSS community.

You have hands-on experience with these frameworks, deep OSS respect, and 4+ years in security engineering, with a track record of PRs and responsible disclosure. You communicate clearly and thrive in public collaboration.

Qualifications

• You've actually used or broken these frameworks: Turborepo, Nuxt, Svelte/SvelteKit, SWR, Workflow, or Nitro.
• You have a deep appreciation and respect for open source work.
• 4+ years in security engineering with hands-on OSS contributions.
• You're energized by root-cause security improvements, not remediation counts.
• You can read framework internals and have strong JS/TS fundamentals.

Responsibilities

• Hunt for vulnerability classes by running deep security assessments of framework internals.
• Drive root-cause framework fixes with upstream design changes.
• Own vulnerability disclosure and CVEs, coordinating with OSS projects and researchers.
• Run the OSS bug bounty program: triage, reproduce, and coordinate fixes with maintainers.
• Engage with maintainers during RFCs and design reviews to bake security in from the start.

Skills

Turborepo/Nuxt/SvelteKit

JS/TS fundamentals

Open source security

Vulnerability research

Communication

Tools

GitHub

Job description

United States Digital Space LLC in San Francisco seeks a security engineer to defend open source projects like Turborepo, Nuxt, SvelteKit, SWR, and Nitro. You will hunt vulnerability classes, design framework-level fixes, and own CVE coordination with the OSS community.

You have hands-on experience with these frameworks, deep OSS respect, and 4+ years in security engineering, with a track record of PRs and responsible disclosure. You communicate clearly and thrive in public collaboration.