Security Software Engineer, Open Source Frameworks

<div class="content-intro"><h2>About Vercel:</h2> <p><span data-sheets-root="1">Vercel is the agentic infrastructure company, freeing people and agents to ship what's next. For more than a decade we've helped builders move from idea to production with speed, security, and exceptional developer experience.</span></p> <p><span data-sheets-root="1">Now we're scaling our products for both agents and people to ship and run software, built in the open and trusted by OpenAI, PayPal, Ramp, Supreme, and millions of developers worldwide.</span></p></div><h2>About The Role:</h2> <p>Vercel builds and maintains a broad portfolio of open source projects that power the modern web, running in millions of applications. Your primary focus will be <strong>Turborepo, Nuxt, Svelte/SvelteKit, SWR, Workflow, and Nitro</strong>. A single structural fix at the framework level protects every one of those applications at once, which makes this one of the highest-leverage security roles at the company.</p> <p>We're looking for a security engineer who loves finding a whole class of vulnerability and eliminating it in one move, not someone who's satisfied filing one bug at a time. You'll run deep security assessments of framework internals (routing, middleware, caching, server actions, the build pipeline), find the systemic patterns that produce entire families of bugs, and drive the framework-level fixes and design changes that remove them permanently. You'll also own how these projects handle externally reported vulnerabilities, coordinated disclosure, and CVEs, working directly with maintainers and the open source security community. This includes hands-on ownership of Vercel's open source bug bounty program for these projects: triaging incoming reports, validating and reproducing findings, and driving fixes with the right maintainers.</p> <h2>What You Will Do:</h2> <ul> <li><strong>Hunt for vulnerability classes, not individual bugs:</strong> Run deep security assessments of framework internals (routing, middleware, caching, data fetching, server actions/RSC boundaries, build tooling) to find the systemic design patterns that produce whole families of issues.</li> <li><strong>Drive root-cause framework fixes:</strong> Push design changes upstream that eliminate a category of vulnerability across every application built on the framework, rather than patching individual instances as they're reported.</li> <li><strong>Own vulnerability disclosure and CVEs:</strong> Triage security reports from the community and researchers across Turborepo, Nuxt, Svelte/SvelteKit, SWR, Workflow, Nitro, and other maintained OSS projects. Coordinate embargoed fixes, write and publish advisories, and manage the CVE/CNA process en