Product Security Engineer - LLM-Driven Triage & Bug Bounty

Vercel Inc.; New York (NY); Hybrid; USD 208,000 - 312,000; Full time

Benefits offered by this job

Equity

Healthcare package

Mentorship and events

WFH budget

Flexible time off

Job summary

Vercel Inc. is seeking a Product Security Engineer for a hybrid role based in San Francisco or New York City, with three days in the office.

You will build systems that triage externally reported vulnerabilities and validate findings using LLM/agent-based tooling, tracing issues to root causes and proposing fixes. You will own the bug bounty program, shape security testing capabilities for customers, and collaborate with engineering to raise the company’s security bar while maintaining fast

Qualifications

• 5+ years of software or security engineering experience building and shipping production systems or internal tools.
• Wrote production code in JavaScript/TypeScript on Node.js with hands-on experience in web frameworks like Next.js or React.
• Built with LLM or agent-based tooling.
• Reproduced and assessed externally reported vulnerabilities, including judging severity.

Responsibilities

• Build systems to triage externally reported vulnerabilities with high volume and accuracy.
• Develop LLM/agent-based analysis to validate business logic, authentication, and design-level findings.
• Trace validated findings to root cause and propose fixes for well-understood vulnerability classes with human review gates.
• Own the bug bounty program, including scope, policy, and researcher engagement, feeding results into automated triage.
• Extend tooling to security testing capabilities that customers can use on their builds and deployments.

Skills

JavaScript/TypeScript

Node.js

Security engineering

Production systems

LLM/agent tooling

Tools

Next.js

React

Job description

Vercel Inc. is seeking a Product Security Engineer for a hybrid role based in San Francisco or New York City, with three days in the office.

You will build systems that triage externally reported vulnerabilities and validate findings using LLM/agent-based tooling, tracing issues to root causes and proposing fixes. You will own the bug bounty program, shape security testing capabilities for customers, and collaborate with engineering to raise the company’s security bar while maintaining fast