1 month ago
Berlin, Germany +3 moreMid Level
H1B Sponsor
Base Salary
$208k - $312k/yr
Responsibilities
- Assess framework internals to identify systemic vulnerability classes across routing, middleware, caching, data fetching, server actions/RSC boundaries, and build tooling.
- Drive upstream framework design changes that eliminate vulnerability categories rather than isolated bugs.
- Triage security reports, reproduce findings, assess severity, coordinate embargoed fixes, publish advisories, and manage CVE/CNA processes.
- Own the open source bug bounty program for Turborepo, Nuxt, Svelte/SvelteKit, SWR, Workflow, Nitro, and other maintained projects.
- Partner with maintainers and core teams on security-focused RFCs and design reviews.
- Build linters, codemods, and CI checks to prevent regressions.
- Harden dependency, release, package-building, signing, and distribution processes for open source projects.
- Collaborate publicly with maintainers, contributors, external researchers, and security communities.
Requirements
- 4+ years of security engineering experience, ideally including hands-on open source contributions.
- Practical experience using or breaking Turborepo, Nuxt, Svelte/SvelteKit, SWR, Workflow, Nitro, or comparable projects.
- Strong JavaScript and TypeScript fundamentals and the ability to read framework internals involving routing, SSR/RSC, middleware, and build systems.
- Experience with structured security assessments, coordinated or responsible disclosure, embargoes, and writing security advisories.
- Ability to communicate security issues, tradeoffs, and design recommendations clearly with maintainers, contributors, researchers, and non-security engineers.
- CVE credits or published security research, major open source project contributions, supply chain security tooling experience, AI-agent contribution risk knowledge, or bug bounty program experience are preferred.
Benefits
- Competitive compensation package including equity
- Inclusive healthcare package
- Mentorship and support for attending professional events
- Flexible time off
- Company-provided work equipment and work-from-home budget
Tech Stack
Categories
About Vercel
Vercel is the platform where humans and AI agents build, ship, and scale software together. Trusted by OpenAI, Meta, Ramp, and Supreme, we free the world to ship what's next.