Product Security Engineer

Vercel's product security team is building systems that handle security findings at volume instead of triaging each one by hand. This role is aimed at a software engineer who wants to automate the assessment and repair of vulnerabilities, and it also carries the bug bounty programme. Offices are listed in San Francisco, New York City, London and Berlin, hybrid with anchor days on Monday, Tuesday and Friday for anyone within commuting distance, and fully remote for those further out.

What you would work on - Building tooling that triages and validates incoming bug bounty reports automatically at scale - Developing LLM and agent based reasoning that judges whether a report is valid, how severe it is and whether it reproduces - Tracing confirmed findings back to root causes and the underlying vulnerability classes behind them - Designing systems that propose or open fixes on their own for well understood classes of bug - Rethinking conventional security tooling where it does not hold up at Vercel's scale - Running the bug bounty programme, covering both researcher relations and internal process - Extending security testing so customers can make use of it

What they are looking for - A strong software engineering background, which the posting weights above penetration testing experience - Understanding of how vulnerabilities are triaged, validated and rated for severity - Familiarity with agentic and LLM based security tooling - A root cause and systems oriented approach rather than case by case fixing - Comfort defining practice in an area where conventions are still forming - Solid JavaScript and TypeScript, plus Node.js runtime security knowledge and familiarity with modern web frameworks

Stack: JavaScript, TypeScript, Node.js, Next.js, React, LLM agents

Compensation: The employer publishes a San Francisco base range of $208,000 to $312,000 USD.