Senior Application Security Engineer Hybrid - San Francisco

About Vercel :

Vercel gives developers the tools and cloud infrastructure to build, scale, and secure a faster, more personalized web. As the team behind v0, Next.js, and AI SDK, Vercel helps customers like Ramp, Supreme, PayPal, Chick-fil-A, and Under Armour build for the AI-native web.

Our mission is to enable the world ship the best products. That starts with creating a place where everyone can do their best work. Whether you're building on our platform, supporting our customers, or shaping our story : You can just ship things.

About the Role :

We are looking for a Senior Application Security Engineer to join our security team (reporting to the Head of Security). In this role, you will drive critical application security initiatives across Vercel’s products and platform. Your core focus will be onthreat modeling, open-source software security, secure code review, SDLC tooling, andbug bounty program management. You will support both our internal product engineering teams and customer-facing security programs, ensuring that security is embedded throughout our development lifecycle and that our platform earns the trust of developers and end-users alike.

As a senior member of the team, you willlead cross-organizational security projects and champion a security-first culture within Vercel’s engineering organization. This is a high-impact role with broad scope – your work will not only secure Vercel’s core infrastructure and applications (built with Next.js, Node.js, and serverless architecture), but also influence the security of the open-source ecosystems we contribute to.

This is a hybrid role based at our San Francisco office with three days in the office per week.

What You Will Do :

• Threat Modeling & Design Review : Partner with engineering and product teams to perform threat modeling for new and existing features. Identify potential risks early in the design phase and recommend security controls or design changes to mitigate threats. You will ensure security concerns are addressed from the inception of features through deployment.
• Secure Code Review : Conduct secure code reviews and security assessments on applications and services built with Next.js, Node.js, and our serverless backend. You’ll uncover code-level vulnerabilities, provide actionable remediation guidance to developers, and establish best practices for secure coding across the engineering team.
• Open Source Security Management : Oversee Vercel’s open-source security efforts. This includes monitoring and coordinating fixes for vulnerabilities in third-party open-source packages we use (as a consumer) and ensuring the security of the open-source projects we maintain and publish (as a contributor / publisher, e.g. Next.js). You will work with maintainers and the community on responsible disclosure and patching of security issues in open-source code.
• SDLC Tooling & Automation : Evaluate, select, and integrate security tools into our Software Development Life Cycle. You will drive the implementation of automated security checks – for example, usingGitHub Advanced Security (GHAS)and other static analysis, dependency scanning, and secret detection tools – directly in our CI / CD pipelines and GitHub workflows. By embedding security tooling into developer workflows, you will help catch issues early and reduce manual effort.
• Bug Bounty Program Management : Own and expand Vercel’s bug bounty program. You will triage and validate incoming vulnerability reports from the security researcher community, ensure critical issues are promptly addressed, and coordinate cross-team efforts to remediate and learn from reported vulnerabilities. You’ll also work on making our bug bounty a world-class, researcher-friendly program, including refining policies, scope, and engagement to encourage high-quality submissions.
• Cross-Organizational Security Initiatives : Lead and contribute to security projects that span multiple teams and disciplines. For example, you might drive a company-wide upgrade to a more secure framework, implement a new authentication / authorization mechanism in collaboration with product teams, or roll out a security awareness program for engineers. You will act as asecurity championacross the org, aligning stakeholders from Engineering, DevOps, Product, and other groups to implement lasting security improvements.
• Customer-Facing Security Support : Work closely with customer success and product marketing on security-related initiatives that impact our users. This may involve contributing to security documentation and whitepapers, assisting with customer security questionnaires or audits by providing application security expertise, and communicating our security features and best practices to build customer trust in the platform.

About You :

Bonus If You :

Benefits :

The San Francisco, CA base pay range for this role is $216,000-$324,000. Actual salary will be based on job-related skills, experience, and location. Compensation outside of San Francisco may be adjusted based on employee location, and the total package includes benefits and equity-based compensation. Your recruiter can share more details during the hiring process.

Vercel is committed to fostering and empowering an inclusive community within our organization. We do not discriminate on the basis of race, religion, color, gender expression or identity, sexual orientation, national origin, citizenship, age, marital status, veteran status, disability status, or any other characteristic protected by law. Vercel encourages everyone to apply for our available positions, even if they don't necessarily check every box on the job description.

#LI-LC1

#J-18808-Ljbffr