Security Software Engineer, IAM

ABOUT VERCEL: Vercel is the agentic infrastructure company. We free people and agents to ship what’s next. For more than a decade, Vercel has shaped how the web is built. As the team behind Next.js, v0, and AI SDK, we create products that help builders move from idea to production with speed, security, and exceptional developer experience. Now, software is entering a new era, and the next generation of products will not just be used by people. They will be built, extended, and operated by agents. We are building the platform for that future, trusted by companies like OpenAI, PayPal, Ramp, Supreme, and millions of developers worldwide. Whether you’re building our products, supporting our customers, growing our community, or shaping our story, you’ll help define what comes next. As a Software Engineer on our Trust & Safety team at Vercel, you’ll build and operate systems that protect millions of developers and projects from abuse at internet scale. You’ll analyze real-world threat actor behavior, detect emerging abuse patterns across large datasets, and design production-ready mitigations to keep the platform safe without slowing developers. This role blends security engineering, data analysis, and applied LLM techniques, working closely with product, infrastructure, and security teams to turn evolving threats into scalable defenses. If you’re based within a pre-determined commuting distance of one of our offices (SF, NY, London, or Berlin), the role includes in-office anchor days on Monday, Tuesday, and Friday. If you're located beyond that distance, the role is fully remote. For location-specific details, please connect with our recruiting team. WHAT YOU WILL DO: * Analyze threat actor behavior and evolving abuse patterns across large, heterogeneous datasets to inform detection logic, policy decisions, and scalable mitigations. * Research, prototype, and implement state-of-the-art LLM-driven techniques for abuse detection, classification, and prevention. * Design and develop production-ready systems that detect and disrupt abusive behavior across the Vercel platform. * Build, maintain, and fine-tune internal tools, datasets, and evaluation pipelines for trust and safety workflows. * Collaborate closely with security, product, and infrastructure teams to bring research ideas into stable, scalable production systems. ABOUT YOU: * 5+ years of experience in abuse prevention, trust & safety, or security engineering. * Strong programming skills in JavaScript/TypeScript and Python. * Hands-on experience working with LLMs, including prompt engineering, evaluation, and fine-tuning. * Collaborate closely with security, product, and infrastructure teams to bring research ideas into stable, scalable production systems. * Solid understanding of cloud infrastructure, including AWS. * Strong understanding of real-world threat actor behavior and abuse tactics. * Experience owning systems end-to-end, from initial research through production deployment and iteration.     BENEFITS: * Competitive compensation package, including equity. * Inclusive Healthcare Package. * Learn and Grow - we provide mentorship and send you to events that help you build your network and skills. * Flexible Time Off. * We will provide you the gear you need to do your role, and a WFH budget for you to outfit your space as needed. The San Francisco, CA base pay range for this role is $208,000 - $312,000. Actual salary will be based on job-related skills, experience, and location. Compensation outside of San Francisco may be adjusted based on employee location. The total compensation package may include benefits, equity-based compensation, and eligibility for a company bonus or variable pay program depending on the role. Your recruiter can share more details during the hiring process.  Vercel is committed to fostering and empowering an inclusive community within our organization. We do not discriminate on the basis of race, religion, color, gender expression or identity, sexual orientation, national origin, citizenship, age, marital status, veteran status, disability status, or any other characteristic protected by law. Vercel encourages everyone to apply for our available positions, even if they don't necessarily check every box on the job description.

ABOUT VERCEL: Vercel is the agentic infrastructure company. We free people and agents to ship what’s next. For more than a decade, Vercel has shaped how the web is built. As the team behind Next.js, v0, and AI SDK, we create products that help builders move from idea to production with speed, security, and exceptional developer experience. Now, software is entering a new era, and the next generation of products will not just be used by people. They will be built, extended, and operated by agents. We are building the platform for that future, trusted by companies like OpenAI, PayPal, Ramp, Supreme, and millions of developers worldwide. Whether you’re building our products, supporting our customers, growing our community, or shaping our story, you’ll help define what comes next. ABOUT THE ROLE: We're looking for a Security Engineer to join our Cloud Security Engineering team. In this role, you'll help strengthen the security of our platform by building and improving the controls that protect our infrastructure. You'll play a key role in making security a core part of how we build, deploy, and scale our systems, while helping the company grow securely and confidently. You'll report to the Security Operations Manager, and this is a hybrid or fully remote within the United States. If you're based within commuting distance of our SF or NY offices, the role includes in-office anchor days on Monday, Tuesday, and Friday. WHAT YOU WILL DO: * Design and implement scalable security controls across our cloud-native platform. * Harden infrastructure components using infrastructure-as-code, policy enforcement, and service isolation. * Build secure by default infrastructure and code CI/CD pipelines. * Collaborate with platform and infrastructure teams to integrate security best practices into architecture and workflows. * Stay ahead of cloud security trends and adopt cutting-edge technologies to enhance platform resilience. * Conduct threat modeling, risk analysis, and mitigation planning for critical systems. * Drive improvements in monitoring, detection, and incident response at the platform level. * Build, deploy and maintain relevant tooling. ABOUT YOU: * 8+ years of experience in infrastructure or platform security roles. * Deep understanding of secure cloud infrastructure (AWS/GCP), identity and access management, and system hardening. * Proficient with tools like Terraform, CDK, Kubernetes, and CI/CD security. * Skilled at balancing engineering realities with principled security practices. * Proven track record of shipping secure, resilient systems at scale. BONUS IF YOU: * Have built or scaled security automation pipelines. * Contributed to open-source security projects or tools. * Hold certifications such as GCP Security Engineer, AWS certifications, CISSP, or OSCP. * Hold a bachelors or masters degree in Cybersecurity or similar disciplines. BENEFITS: * Competitive compensation package, including equity. * Inclusive Healthcare Package. * Learn and Grow - we provide mentorship and send you to events that help you build your network and skills. * Flexible Time Off. * We will provide you the gear you need to do your role, and a WFH budget for you to outfit your space as needed. The San Francisco, CA base pay range for this role is $208,000.00 - $312,000.00. This salary range is an estimate. Actual salary will be based on job related skills, experience and location. Pay ranges outside San Francisco may be adjusted based on employee location. The total compensation package also includes benefits and equity-based compensation. Your recruiter can share more about the specific pay range for your location during the hiring process.