Senior Security Software Engineer, v0

• Sit fully embedded inside the v0 team as a peer engineer who owns security end to end for everything v0 ships — not a rotating auditor who reviews designs and files tickets. • v0 turns natural language into working, deployed applications, making it one of the most interesting and highest-stakes security surfaces at Vercel: sandboxed code execution, multi-tenant isolation, permission boundaries, and resistance to prompt injection and tool misuse. • Evaluated as much on shipped product velocity as on security outcomes — you'll build features, fix bugs, and ship to production alongside the rest of the team. • Available in London, Berlin, New York, or San Francisco. If based within commuting distance of the London office, the role includes in-office anchor days on Monday, Tuesday, and Friday. Otherwise the role is fully remote.

• Be a software engineer first — have 5+ years building and shipping production web applications, operating independently at IC4/Senior level. • Have strong full-stack fundamentals, comfortable in TypeScript, React, and Node, working in the same codebase, PR flow, and velocity as the rest of the v0 team. • Have real security judgement — understand authN/authZ design, sandboxing and isolation, injection vulnerability classes, and be able to reason about "an AI agent writing and running code" as a novel attack surface. • Influence through code, not just process — you'd rather fix the root cause in a PR than write a policy doc about it. • Be comfortable with ambiguity — v0's threat model is still being written, and you're excited to define it. • Be willing to build with v0, not just secure it — actually use it to build things and understand how the products work end to end.

• Already be a v0 user or familiar with how it and Vercel's broader product line work. • Have hands-on experience with sandboxing, container isolation, or multi-tenant systems. • Have done prompt injection, jailbreak, or LLM application security research on an agentic or AI-powered product. • Have previously shipped a coding agent, dev tool, or code-generation product end to end. • Hold relevant security certifications (OSCP, OSWE) or have notable bug bounty or CTF history. • Enjoy building content and talking publicly about your work through blog posts, conference talks, or research writeups.

• Proactively hunt for vulnerabilities across v0 and ship the fix, not just the finding. • Build security features directly into the product: sandboxing/isolation controls, permission boundaries, abuse detection, and safe defaults for generated apps. • Be the security reviewer of record for everything the team ships before it goes out the door. • Own the HackerOne relationship for v0: triage, validate, and drive fixes for reports from Vercel's researcher community. • Own and continuously refine the v0 threat model, including sandbox/runtime isolation, permission boundaries between agent actions and user intent, and defences against prompt injection and tool-use abuse. • Work directly on how agent-generated code is scoped, sandboxed, and constrained before it touches real infrastructure. • Create patterns, libraries, and checks that let v0 engineers ship new capabilities quickly without reintroducing known bug classes. • Share threat models, incident learnings, and SDLC tooling with the broader security team while making the final call on v0-specific tradeoffs. • Be the first responder and technical owner when a security issue is reported against v0.

• Receive competitive compensation package, including equity. • Get an inclusive healthcare package. • Access mentorship and events that help you build your network and skills. • Take flexible time off. • Receive gear for your role and a work-from-home budget to outfit your space.

Vercel is the agentic infrastructure company, freeing people and agents to ship what's next. As the team behind Next.js, v0, and AI SDK, Vercel creates products that help builders move from idea to production with speed, security, and exceptional developer experience. Trusted by companies like OpenAI, PayPal, Ramp, Supreme, and millions of developers worldwide.