Security Software Engineer, Detection & Response

Builds the sensors, log pipeline and response tooling behind Vercel's Detection & Response team, treating detection and response as software rather than working an alert queue. The engineer rolls out osquery and eBPF telemetry across hosts, containers and endpoints in several clouds, runs the SIEM pipeline with detections kept as tested code, automates actions such as host isolation and credential revocation, and tests where AI agents can safely help responders. Corporate EDR, email security and GitHub controls, on-call shifts, managed SOC escalations and audit evidence automation are part of it too. Vercel wants five or more years of security, infrastructure or platform engineering, production Go or Rust plus Python or Bash, fleet-scale telemetry, AWS with Terraform, and SIEM operations. Hybrid, three office days a week in San Francisco, New York or London.