Security Engineer for Open Source Frameworks

Vercel; San Francisco (CA); Hybrid; USD 180,000 - 240,000; Full time

Job summary

Vercel is seeking a security engineer who enjoys identifying broad vulnerability classes and eliminating them at the source. You will perform deep security assessments of framework internals and own how reported issues are coordinated across OSS projects such as Turborepo, Nuxt, Svelte/SvelteKit, SWR, Workflow, and Nitro.

You will drive design changes to remove classes of vulnerabilities, manage coordinated disclosures, and own the OSS bug bounty program.

Qualifications

• Experience building security tooling and automations.
• Deep understanding of security vulnerabilities in modern web frameworks and OSS.
• Familiarity with coordinated disclosure and CVE processes.

Responsibilities

• Hunt for vulnerability classes by running deep security assessments of framework internals (routing, middleware, caching, data fetching, server actions, build tooling).
• Drive root-cause framework fixes by pushing upstream design changes that prevent categories of vulnerabilities across all apps.
• Own vulnerability disclosure and CVEs: triage reports, coordinate embargoed fixes, write advisories and manage CVE/CNA processes end to end.
• Run the OSS bug bounty program: triage, validate reports, reproduce findings, coordinate fixes with maintainers and researchers.
• Get security into design early: collaborate with maintainers during RFCs and design reviews to ship secure features from the start.
• Build preventive tooling: contribute linters, codemods, and CI checks to prevent regressions of vulnerability classes.
• Own supply chain security for these projects: review dependencies, releases and package publishing, especially with AI-assisted contributions.
• Work with the community: engage maintainers and researchers as peers and advocate for coordinated disclosure norms.

Job description

Vercel is seeking a security engineer who enjoys identifying broad vulnerability classes and eliminating them at the source. You will perform deep security assessments of framework internals and own how reported issues are coordinated across OSS projects such as Turborepo, Nuxt, Svelte/SvelteKit, SWR, Workflow, and Nitro.

You will drive design changes to remove classes of vulnerabilities, manage coordinated disclosures, and own the OSS bug bounty program.