Product Security Engineer
At its midpoint, $260k/yr, this role pays more than the $218k/yr midpoint for Application & Product Security openings today (usual band $171k–$346k/yr).
The full posting
About Vercel
Vercel is the agentic infrastructure company, freeing people and agents to ship what's next. For more than a decade we've helped builders move from idea to production with speed, security, and exceptional developer experience.
Now we're scaling our products for both agents and people to ship and run software, built in the open and trusted by OpenAI, PayPal, Ramp, Supreme, and millions of developers worldwide.
About the role
We are looking for a Product Security Engineer to build the systems that triage and validate bug bounty and other externally reported security findings, not to work the queue. This role suits a software engineer moving into security or a security engineer with a strong engineering background. You will build large language model (LLM) and agent-based tooling that validates findings, traces them to their root cause, and opens fixes for well-understood vulnerability classes. This is a hybrid role based in San Francisco or New York City, with three days a week in the office.
What you’ll do
- Build the systems that take in externally reported vulnerabilities and assess validity, severity, and reproducibility at a volume manual triage cannot match
- Build LLM and agent-based analysis that validates business logic, authentication, and design-level findings, not just known signatures
- Build systems that trace validated findings to their root cause and propose, and increasingly open, fixes for well-understood vulnerability classes, with human review gates
- Own the bug bounty program, including scope, policy, and researcher engagement, and feed every resolved report back into automated triage
- Extend the tooling into security testing capabilities that customers can use on what they build and deploy
What you need
- 5+ years of software engineering or security engineering experience, building and shipping production systems or internal tools
- Wrote production code in JavaScript/TypeScript on Node.js, with hands-on experience in web frameworks such as Next.js or React
- Built with LLM or agent-based tooling
- Reproduced and assessed externally reported vulnerabilities, including judging severity
Bonus if you
- Built security automation used across an engineering org, not just for your own team
- Built systems that auto-generate or propose code fixes, not just findings
- Tested or secured multi-tenant platforms where customer-built applications run on shared infrastructure
Compensation & Benefits
- Competitive compensation package, including equity.
- Inclusive Healthcare Package.
- Learn and Grow - we provide mentorship and send you to events that help you build your network and skills.
- Flexible Time Off.
- We will provide you the gear you need to do your role, and a WFH budget for you to outfit your space as needed.
The San Francisco, CA base pay range for this role is $208,000.00 - $312,000.00. Actual salary will be based on job-related skills, experience, and location. Compensation outside of San Francisco may be adjusted based on employee location. The total compensation package may include benefits, equity-based compensation, and eligibility for a company bonus or variable pay program depending on the role. Your recruiter can share more details during the hiring process.
Disclosures
- Privacy: Please review our Job Applicant Privacy Policy for more information on how we handle your data.
- Equal Opportunity: Vercel is committed to fostering and empowering an inclusive community within our organization. We do not discriminate on the basis of race, religion, color, gender expression or identity, sexual orientation, national origin, citizenship, age, marital status, veteran status, disability status, or any other characteristic protected by law. Vercel encourages everyone to apply for our available positions, even if they don't necessarily check every box on the job description.
Text as Vercel published it; last compared with the original on 11 Nov 2026.
The application
Your details, CV and LinkedIn, then 7 questions.
- 1.Are you currently based in any of these countries? Please note these are the only countries where we are accepting applicationsPick one (9 options)
- 2.Do you live in one of the following states? Alabama, Alaska, Delaware, Kansas, Maine, Mississippi, Montana, Nebraska, New Mexico, North Dakota, South Dakota, West Virginia, or Wyoming.Yes or no
- 3.What is your preferred work location? * San Francisco (open to relocation) * New York City (open to relocation) * Open to either San Francisco or New York City * Remote preferred/Not open to relocationShort answer · optional
- 4.Your authorization to work in the country where you live. Please choose the option that describes your work authorization.Pick one
- 5.Will you require Visa Sponsorship now, or in the future?Yes or no
- 6.Where did you first hear about this role?Pick one (14 options)
- 7.Please double-check all the information provided above. Ensuring accuracy is crucial, as any errors or omissions may impact the review of your application.Pick one: I have reviewed and confirmed that all the information provided is accurate and complete.
Taken from Vercel's application form as it stood on 11 Nov 2026.
The employer: Vercel
Vercel hosts and scales web apps and created Next.js; its security team is hiring detection and response, identity, cloud and product security engineers.
Pay and benefits: Hybrid and remote roles with startup equity.
Want companies to ask for you?
Security teams sometimes ask us directly for someone with a given specialty, clearance or certification. Join the candidate pool once and we put you forward when a brief matches, and only after you say yes. No cost to you.
Hear first when Vercel posts a security role
We read Vercel's careers system around the clock and send its new security roles in a weekly email, along with comparable openings at other employers. Free; leave whenever you like.