Vercel is hiring a Product Security Engineer

Responsibilities

• Partner with engineering and product teams to perform threat modeling for new and existing features.
• Identify potential risks early in the design phase and recommend security controls or design changes to mitigate threats.
• Ensure security concerns are addressed from the inception of features through deployment.
• Conduct secure code reviews and security assessments on products and services built with Next.js, Node.js, and our serverless backend.
• Uncover code-level vulnerabilities, provide actionable remediation guidance to developers, and establish best practices for secure coding across the engineering team.
• Oversee Vercel’s open-source security efforts.
• Monitor and coordinate fixes for vulnerabilities in third-party open-source packages we use (as a consumer).
• Ensure the security of the open-source projects we maintain and publish (as a contributor/publisher, e.g. Next.js).
• Work with maintainers and the community on responsible disclosure and patching of security issues in open-source code.
• Evaluate, select, and integrate security tools into our Software Development Life Cycle.
• Drive the implementation of automated security checks – for example, using GitHub Advanced Security (GHAS) and other static analysis, dependency scanning, and secret detection tools – directly in our CI/CD pipelines and GitHub workflows.
• Catch issues early and reduce manual effort by embedding security tooling into developer workflows.
• Own and expand Vercel’s bug bounty program.
• Triage and validate incoming vulnerability reports from the security researcher community.
• Ensure critical issues are promptly addressed.
• Coordinate cross-team efforts to remediate and learn from reported vulnerabilities.
• Make our bug bounty a world-class, researcher-friendly program, including refining policies, scope, and engagement to encourage high-quality submissions.
• Lead and contribute to security projects that span multiple teams and disciplines.
• Drive a company-wide upgrade to a more secure framework, implement a new authentication/authorization mechanism in collaboration with product teams, or roll out a security awareness program for engineers.
• Act as a security champion across the org, aligning stakeholders from Engineering, DevOps, Product, and other groups to implement lasting security improvements.
• Work closely with customer success and product marketing on security-related initiatives that impact our users.
• Contribute to security documentation and whitepapers.
• Assist with customer security questionnaires or audits by providing product security expertise.
• Communicate our security features and best practices to build customer trust in the platform.

Requirements

• 5+ years of experience in a Product Security or Product Security role (or related field), with a track record of securing web products and services.
• Well-versed in the fundamentals of product security and have hands-on experience finding and fixing vulnerabilities.
• Strong familiarity with JavaScript/TypeScript and Node.js runtime security.
• Experience with modern web frameworks (ideally Next.js or React and Node-based frameworks) and understanding of their security considerations.
• Ability to read and review code in these technologies to spot security flaws.
• Demonstrated ability to perform threat modeling and architectural risk analysis for complex product.
• Understanding of how to integrate security into a fast-paced SDLC without slowing it down.
• Experience implementing or working with secure development lifecycle practices (secure design, code review, pentesting, etc.).
• Hands-on experience with product security tooling such as static product security testing (SAST), dynamic testing (DAST), dependency vulnerability scanners, and CI/CD pipeline security integration.
• Familiarity with GitHub Advanced Security or similar tools for code scanning and secret detection is a strong plus.
• Knowledge of open-source security best practices.
• Experience dealing with open-source dependencies and package management security (e.g., handling vulnerability advisories, using tools like Dependabot or Snyk).
• Exposure to running or participating in a bug bounty program or vulnerability disclosure process.
• Ability to assess externally reported issues, reproduce and validate vulnerabilities, and coordinate fixes.
• Stay up-to-date on the latest vulnerabilities (OWASP Top 10, emerging threats) and methods to mitigate them.
• Solid understanding of cloud architecture and serverless environments from a security perspective.
• Familiarity with securing products on cloud platforms (e.g., securing serverless functions, protecting APIs, managing secrets and keys).
• Proven ability to drive security initiatives and influence engineering teams to adopt best practices.
• Ability to work cross-functionally to achieve security goals – for example, rolling out a new security tool or standard across many engineers.

Nice to Have

• Prior software development experience beyond security (e.g. as a frontend or backend engineer).
• Ability to empathize with developers and write or contribute code will help integrate security seamlessly into development.
• Hold relevant security certifications or recognitions (for example, OSCP, OSWE, CISSP, or notable bug bounty hall of fame entries).
• Experience with security policy-as-code or infrastructure as code security (for instance, using tools like Open Policy Agent, Terraform security checks, etc.).
• Have built or implemented security features in a product (such as authentication systems, encryption, secure CI/CD pipelines) or contributed to security community projects/tools.
• Are an active participant in the security community (e.g., contributing to open source security projects, writing blog posts or research, attending or speaking at security conferences).

Benefits

• Competitive compensation package, including equity.
• Inclusive Healthcare Package.
• Learn and Grow - we provide mentorship and send you to events that help you build your network and skills.
• Flexible Time Off.
• We will provide you the gear you need to do your role, and a WFH budget for you to outfit your space as needed.

Work Arrangement

Hybrid — SF, NY, London, Berlin

Additional Information

• If you’re based within a pre-determined commuting distance of one of our offices (SF, NY, London, or Berlin), the role includes in-office anchor days on Monday, Tuesday, and Friday.
• If you're located beyond that distance, the role is fully remote.
• For location-specific details, please connect with our recruiting team.
• Vercel is committed to fostering and empowering an inclusive community within our organization.
• We do not discriminate on the basis of race, religion, color, gender expression or identity, sexual orientation, national origin, citizenship, age, marital status, veteran status, disability status, or any other characteristic protected by law.
• Vercel encourages everyone to apply for our available positions, even if they don't necessarily check every box on the job description.