Product Security Engineer

The shape of it

In the posting’s own words

We are looking for a Product Security Engineer to build the systems that triage and validate bug bounty and other externally reported security findings, not to work the queue. This role suits a software engineer moving into security or a security engineer with a strong engineering background. You will build large language model (LLM) and agent-based tooling that validates findings, traces them to their root cause, and opens fixes for well-understood vulnerability classes. This is a hybrid role based in San Francisco or New York City, with three days a week in the office.

What it asks for · 1

• Wrote production code in JavaScript/TypeScript on Node.js, with hands-on experience in web frameworks such as Next.js or React

Also a plus

• Built security automation used across an engineering org, not just for your own team
• Built systems that auto-generate or propose code fixes, not just findings
• Tested or secured multi-tenant platforms where customer-built applications run on shared infrastructure

What the job covers

• Build the systems that take in externally reported vulnerabilities and assess validity, severity, and reproducibility at a volume manual triage cannot match
• Build LLM and agent-based analysis that validates business logic, authentication, and design-level findings, not just known signatures
• Build systems that trace validated findings to their root cause and propose, and increasingly open, fixes for well-understood vulnerability classes, with human review gates
• Own the bug bounty program, including scope, policy, and researcher engagement, and feed every resolved report back into automated triage
• Extend the tooling into security testing capabilities that customers can use on what they build and deploy

Tools and skills named

Words the posting leans on

• security7×
• build6×
• findings5×
• systems5×
• engineering4×
• built3×
• externally reported3×
• fixes3×
• llm3×
• status3×
• triage3×
• validates3×
• agent-based tooling2×
• bug bounty2×
• code2×
• every2×

Counted from the posting after the mission statement and the legal notices are set aside. The ones near the top are the ones a screener is looking for.

More open at Vercel

• Account Executive, CommercialRemote - Germany
• Account Executive, MajorsHybrid - London
• Account Executive, Majors (APAC)Hybrid - Sydney
• Account Executive, Majors- Install Base (APAC)Hybrid - Sydney
• Account Executive-Startups, EMEA (French Speaker)Hybrid - London
• Account Executive- Startups, GreenfieldHybrid - San Francisco, New York City, Austin