Security Software Engineer, Detection & Response
At its midpoint, $260k/yr, this role pays more than the $177k/yr midpoint for Security Operations & Incident Response openings today (usual band $145k–$314k/yr).
The full posting
About Vercel
Vercel is the agentic infrastructure company, freeing people and agents to ship what's next. For more than a decade we've helped builders move from idea to production with speed, security, and exceptional developer experience.
Now we're scaling our products for both agents and people to ship and run software, built in the open and trusted by OpenAI, PayPal, Ramp, Supreme, and millions of developers worldwide.
About the role
We are looking for a Security Software Engineer, Detection & Response, to build the telemetry, logging, and response systems for our Detection & Response team. This is a builder role, not a queue-triage role. You will build detection and response as software across a multi-cloud fleet of servers, containers, and endpoints, and test where AI and agents can safely take work off responders. This is a hybrid role based in San Francisco, New York City, or London, with three days a week in the office.
What you’ll do
- Deploy and operate telemetry at fleet scale with osquery and extended Berkeley Packet Filter (eBPF) sensors across servers, containers, and endpoints, and own performance overhead, staged rollouts, canaries, and rollbacks
- Build and maintain the logging and security information and event management (SIEM) pipeline behind detection, including ingestion, normalization, enrichment, storage, and cost, with detections written as code with tests, code review, and continuous integration and continuous delivery (CI/CD)
- Automate response with tooling for host isolation, credential revocation, evidence collection, and enrichment, and test where AI and agents can safely take work off responders
- Strengthen the corporate security stack, including endpoint detection and response (EDR) and fleet management across Mac, Windows, and Linux, email security, and GitHub controls
- Join the on-call rotation, work with the managed security operations center (SOC) on escalations, and automate evidence collection for System and Organization Controls 2 (SOC 2), Payment Card Industry Data Security Standard (PCI DSS), and ISO audits
What you need
- 5+ years in security, infrastructure, or platform engineering, writing production code in a compiled language (Go or Rust preferred) and a scripting language (Python or Bash)
- Deployed and operated agents, sensors, or telemetry collectors at fleet scale, such as osquery or eBPF-based tooling
- Operated AWS infrastructure, including networking, identity and access management (IAM), logging, and container workloads, with infrastructure as code in Terraform
- Built and run a data or logging pipeline, including SIEM operations and SQL for investigation
Bonus if you
- Worked with managed SOC providers or security orchestration, automation, and response (SOAR) platforms
- Built or contributed to open source security or observability tooling
- Know serverless platforms and API security
Benefits & Compensation
- Competitive compensation package, including equity.
- Inclusive Healthcare Package.
- Learn and Grow - we provide mentorship and send you to events that help you build your network and skills.
- Flexible Time Off.
- We will provide you the gear you need to do your role, and a WFH budget for you to outfit your space as needed.
The San Francisco, CA base pay range for this role is $208,000-$312,000. This salary range is an estimate. Actual salary will be based on job-related skills, experience, and location. The total compensation package also includes benefits and equity-based compensation. Your recruiter can share more about the specific pay range for your location during the hiring process.
Disclosures
- Privacy: Please review our Job Applicant Privacy Policy for more information on how we handle your data.
- Equal Opportunity: Vercel is committed to fostering and empowering an inclusive community within our organization. We do not discriminate on the basis of race, religion, color, gender expression or identity, sexual orientation, national origin, citizenship, age, marital status, veteran status, disability status, or any other characteristic protected by law. Vercel encourages everyone to apply for our available positions, even if they don't necessarily check every box on the job description.
Text as Vercel published it; last compared with the original on 11 Nov 2026.
The application
Your details, CV and LinkedIn, then 7 questions.
- 1.Are you currently based in any of these countries? Please note these are the only countries where we are accepting applicationsPick one (9 options)
- 2.Will you require Visa Sponsorship now, or in the future?Yes or no
- 3.Your authorization to work in the country where you live. Please choose the option that describes your work authorization.Pick one
- 4.Do you live in one of the following states? Alabama, Alaska, Delaware, Kansas, Maine, Mississippi, Montana, Nebraska, New Mexico, North Dakota, South Dakota, West Virginia, or Wyoming.Yes or no
- 5.This role requires a hybrid schedule with 2 days per week in the SF office. Are you willing to commit to this hybrid schedule?Yes or no
- 6.Please double-check all the information provided above. Ensuring accuracy is crucial, as any errors or omissions may impact the review of your application.Pick one: I have reviewed and confirmed that all the information provided is accurate and complete.
- 7.Where did you first hear about this role?Pick one (14 options)
Taken from Vercel's application form as it stood on 11 Nov 2026.
The employer: Vercel
Vercel hosts and scales web apps and created Next.js; its security team is hiring detection and response, identity, cloud and product security engineers.
Pay and benefits: Hybrid and remote roles with startup equity.
Let security teams come to you
Security teams sometimes ask us directly for someone with a given specialty, clearance or certification. Join the candidate pool once and we put you forward when a brief matches, and only after you say yes. No cost to you.
Hear first when Vercel posts a security role
We read Vercel's careers system around the clock and send its new security roles in a weekly email, along with comparable openings at other employers. Free; leave whenever you like.