Product Security Engineer

Builds the systems Vercel uses to triage and validate bug bounty submissions and other externally reported vulnerabilities, rather than working the queue by hand. The engineer develops LLM and agent-based tooling that checks validity, severity and reproducibility, including business logic and authentication flaws, traces confirmed issues to their root cause, and proposes or opens fixes behind human review. The role also owns the bug bounty program's scope, policy and researcher relationships, and may extend the tooling into security testing that customers can run on their own apps. Vercel wants five or more years in software or security engineering, production JavaScript or TypeScript on Node.js with Next.js or React, hands-on LLM tooling and experience assessing reported vulnerabilities. Hybrid, three office days a week in San Francisco or New York.