OSS Security Engineer — Frameworks & Vulnerability Research

vercel.com; Town of Berlin (NY); On-site; USD 208,000 - 312,000; Full time

Benefits offered by this job

Equity in compensation

Inclusive Healthcare Package

Mentorship and growth opportunities

Flexible Time Off

WFH equipment budget

Job summary

Vercel is seeking a security engineer to find and eliminate vulnerabilities in open source projects like Turborepo, Nuxt, Svelte/SvelteKit, SWR, Workflow, and Nitro. You will own coordinated disclosure, CVEs, and bug bounty coordination, while shaping framework security from design to deployment.

You will work with maintainers and researchers, build tooling to prevent regressions, and help secure dependencies as AI-assisted contributions grow.

Qualifications

• 4+ years in security engineering, with hands-on OSS contributions.
• Deep understanding of modern JavaScript frameworks and security implications.
• Strong ability to read framework internals and design secure systems.
• Clear communicator with maintainers and researchers.

Responsibilities

• Hunt for vulnerability classes and systemic design patterns in framework internals.
• Drive root-cause framework fixes and upstream changes.
• Own vulnerability disclosure and CVE process end to end.
• Run OSS bug bounty programme and coordinate fixes with maintainers.
• Collaborate with communities and contribute to RFCs and security reviews.
• Create preventive tooling like linters, codemods, and CI checks.
• Strengthen supply chain security for dependencies and releases.

Skills

JavaScript/TypeScript fundamentals

Tools

OSS tooling

Sigstore/SLSA provenance

Job description

Vercel is seeking a security engineer to find and eliminate vulnerabilities in open source projects like Turborepo, Nuxt, Svelte/SvelteKit, SWR, Workflow, and Nitro. You will own coordinated disclosure, CVEs, and bug bounty coordination, while shaping framework security from design to deployment.

You will work with maintainers and researchers, build tooling to prevent regressions, and help secure dependencies as AI-assisted contributions grow.