Security Engineer - Open Source Frameworks & Bug Bounty

Vercel; New York (NY); On-site; USD 208,000 - 312,000; Full time

Benefits offered by this job

Competitive compensation package

Equity

Inclusive Healthcare Package

Mentorship and events

Flexible Time Off

WFH budget

Job summary

Vercel seeks an experienced security engineer to drive framework-level security improvements across Turborepo, Nuxt, Svelte/SvelteKit, SWR, Workflow, and Nitro. You will own how external reports are triaged, validated, and remediated, including CVEs and coordinated disclosure.

You will partner with maintainers, contribute preventive tooling, and ensure security is embedded in design, not after the fact. This role emphasizes open source collaboration and responsible disclosure in a fast-paced

Qualifications

• 4+ years in security engineering, ideally with hands-on OSS contribution
• Strong JavaScript/TypeScript fundamentals and familiarity with modern meta-frameworks

Responsibilities

• Hunt for vulnerability classes, not individual bugs: run deep security assessments of framework internals to find systemic patterns
• Drive root‑cause framework fixes by pushing design changes upstream
• Own vulnerability disclosure and CVEs: triage reports, coordinate embargoed fixes, publish advisories
• Run the OSS bug bounty program: triage, reproduce findings, coordinate fixes with maintainers/researchers
• Get security into design early: collaborate during RFCs and design reviews to bake security in
• Build preventive tooling: contribute linters, codemods, CI checks to prevent regressions
• Own supply chain security: review dependencies, releases, and provenance; manage AI-assisted contributions
• Engage with the community and represent Vercel in coordinated disclosure processes

Skills

Security engineering

Open source

JavaScript/TypeScript

Vulnerability research

Coordinated disclosure

Bug bounty

Job description

Vercel seeks an experienced security engineer to drive framework-level security improvements across Turborepo, Nuxt, Svelte/SvelteKit, SWR, Workflow, and Nitro. You will own how external reports are triaged, validated, and remediated, including CVEs and coordinated disclosure.

You will partner with maintainers, contribute preventive tooling, and ensure security is embedded in design, not after the fact. This role emphasizes open source collaboration and responsible disclosure in a fast-paced