Product Security Engineer

Jobtailor; California (MO); On-site; USD 140,000 - 190,000; Full time

Job summary

Vercel is seeking a Product Security professional to collaborate with engineering and product teams to threat-model features, review secure code, and manage our security tooling and bug bounty program.

The role focuses on securing applications built with Next.js and Node.js, extending security practices across the SDLC, and guiding multiple teams in best security practices to protect users and data.

Qualifications

• 5+ years in a Product Security role or related field securing web products/services.
• Strong familiarity with JavaScript/TypeScript and Node.js runtime security.
• Experience with threat modeling and architectural risk analysis for complex products.
• Hands-on with product security tooling (SAST, DAST, dependency scanners, CI/CD security integration).
• Knowledge of open-source security best practices.
• Exposure to bug bounty programs or vulnerability disclosure processes.
• Understanding of cloud architecture and serverless environments from security perspective.
• Ability to drive security initiatives and influence engineering teams.

Responsibilities

• Partner with engineering and product teams to perform threat modeling for new and existing features.
• Conduct secure code reviews and security assessments on products and services built with Next.js, Node.js, and our serverless backend.
• Oversee open-source security efforts.
• Evaluate, select, and integrate security tools into our SDLC.
• Own and expand bug bounty program.
• Lead and contribute to security projects spanning multiple teams.
• Collaborate with customer success and product marketing on security initiatives affecting users.

Skills

Threat modeling

JavaScript/TypeScript security

Node.js security

SAST

DAST

Dependency scanners

CI/CD security

Cloud/serverless security

Architectural risk analysis

Bug bounty / vulnerability disclosure

Influence engineering teams

Tools

SAST

DAST

Dependency scanners

CI/CD security

Job description

• Partner with engineering and product teams to perform threat modeling for new and existing features.
• Conduct secure code reviews and security assessments on products and services built with Next.js, Node.js, and our serverless backend.
• Oversee Vercel’s open-source security efforts.
• Evaluate, select, and integrate security tools into our Software Development Life Cycle.
• Own and expand Vercel’s bug bounty program.
• Lead and contribute to security projects that span multiple teams and disciplines.
• Work closely with customer success and product marketing on security-related initiatives that impact our users.

Requirements

• 5+ years of experience in a Product Security role (or related field), with a track record of securing web products and services.
• Strong familiarity with JavaScript/TypeScript and Node.js runtime security.
• Demonstrated ability to perform threat modeling and architectural risk analysis for complex product.
• Hands‑on experience with product security tooling such as static application security testing (SAST), dynamic application security testing (DAST), dependency vulnerability scanners, and CI/CD pipeline security integration.
• Knowledge of open‑source security best practices.
• Exposure to running or participating in a bug bounty program or vulnerability disclosure process.
• Solid understanding of cloud architecture and serverless environments from a security perspective.
• Proven ability to drive security initiatives and influence engineering teams to adopt best practices.