About Vercel:

Vercel is the agentic infrastructure company, freeing people and agents to ship what's next. For more than a decade we've helped builders move from idea to production with speed, security, and exceptional developer experience.

Now we're scaling our products for both agents and people to ship and run software, built in the open and trusted by OpenAI, PayPal, Ramp, Supreme, and millions of developers worldwide.

About the role

We are looking for a Product Security Engineer to build the systems that triage and validate bug bounty and other externally reported security findings, not to work the queue. This role suits a software engineer moving into security or a security engineer with a strong engineering background. You will build large language model (LLM) and agent-based tooling that validates findings, traces them to their root cause, and opens fixes for well-understood vulnerability classes. This is a hybrid role based in San Francisco or New York City, with three days a week in the office.

What you’ll do

• Build the systems that take in externally reported vulnerabilities and assess validity, severity, and reproducibility at a volume manual triage cannot match
• Build LLM and agent-based analysis that validates business logic, authentication, and design-level findings, not just known signatures
• Build systems that trace validated findings to their root cause and propose, and increasingly open, fixes for well-understood vulnerability classes, with human review gates
• Own the bug bounty program, including scope, policy, and researcher engagement, and feed every resolved report back into automated triage
• Extend the tooling into security testing capabilities that customers can use on what they build and deploy

What you need

• 5+ years of software engineering or security engineering experience, building and shipping production systems or internal tools
• Wrote production code in JavaScript/TypeScript on Node.js, with hands-on experience in web frameworks such as Next.js or React
• Built with LLM or agent-based tooling
• Reproduced and assessed externally reported vulnerabilities, including judging severity

Bonus if you

• Built security automation used across an engineering org, not just for your own team
• Built systems that auto-generate or propose code fixes, not just findings