Senior Security Software Engineer, v0

Vercel • London, NY

2d • Remote

About The Position

Vercel is seeking a Senior (IC4) software engineer with a strong security background to be fully embedded within the v0 team. This role is not a rotating auditor but a peer engineer responsible for end-to-end security ownership of everything v0 ships. The engineer will find and fix vulnerabilities, build security features directly into the product, review new features before launch, and manage the HackerOne relationship for v0. The role involves being a generalist engineer, building features and fixing bugs, while bringing security judgment and hands-on ownership. The position reports to the security organization but is deployed full-time with v0 and is evaluated on both product velocity and security outcomes. As a senior engineer, the expectation is to operate independently, set the security bar for the team, and make final decisions on v0-specific tradeoffs.

Requirements

• 5+ years of experience building and shipping production web applications at a senior level (IC4/Senior).
• Ability to pick up a normal feature ticket and ship it end to end.
• Strong full-stack fundamentals, comfortable in TypeScript, React, and Node.
• Ability to work within the same codebase, PR flow, and velocity as the v0 team.
• Understanding of authN/authZ design, sandboxing and isolation, and injection vulnerability classes.
• Ability to reason about "an AI agent writing and running code" as a novel attack surface.
• Ability to influence through code rather than solely through process.
• Comfortable with ambiguity and defining threat models.
• Willingness to use v0 to build things and understand the product end to end.

Nice To Haves

• Already a v0 user or familiar with v0 and Vercel's broader product line.
• Hands-on experience with sandboxing, container isolation, or multi-tenant systems.
• Experience with prompt injection / jailbreak / LLM application security research on an agentic or AI-powered product.
• Previous experience shipping a coding agent, dev tool, or code-generation product end to end.
• Relevant security certifications (OSCP, OSWE) or notable bug bounty / CTF history.
• Enjoy building content and talking publicly about work (blog posts, conference talks, research writeups).

Responsibilities

• Proactively hunt for vulnerabilities across v0, from code reviews to system analysis, and ship the fixes.
• Design and implement security-facing functionality, such as sandboxing/isolation controls, permission boundaries, abuse detection, and safe defaults for generated apps, as part of the v0 roadmap.
• Serve as the security reviewer of record for all new v0 features and launches, including new capabilities, generated-app patterns, and integrations.
• Triage, validate, and drive fixes for reports from Vercel's HackerOne researcher community that pertain to v0, collaborating with researchers on reproduction and remediation.
• Own and continuously refine the v0 threat model, covering sandbox/runtime isolation, permission boundaries between agent actions and user intent, and defenses against prompt injection and tool-use abuse.
• Work directly on hardening code execution boundaries, including scoping, sandboxing, and constraining agent-generated code before it runs on Vercel's infrastructure.
• Create patterns, libraries, and checks to enable v0 engineers to ship new generated-app capabilities quickly without reintroducing common bug classes.
• Share threat models, incident learnings, and SDLC tooling with the broader security team, while making final decisions on v0-specific tradeoffs.
• Act as the first responder and technical owner for v0-specific security reports and incidents.
• Reason about potential misuse of v0 by users or agents to attack the system, other tenants, or the platform.

Benefits

• Competitive compensation package, including equity.
• Inclusive Healthcare Package.
• Learn and Grow - mentorship and attendance at events for networking and skill-building.
• Flexible Time Off.
• Company-provided gear and a WFH budget.

What This Job Offers

• Job Type: Full-time
• Career Level: Senior
• Education Level: No Education Listed