Security Software Engineer, Source Frameworks

Responsibilities

• Hunt for vulnerability classes, not individual bugs:
  Run deep security assessments of framework internals.
• Drive root‑cause framework fixes.
• Own vulnerability disclosure and CVEs.
• Run the OSS bug bounty program for these projects.
• Get security into design early.
• Build preventive tooling.
• Own supply chain security for these projects.
• Work with the community, not around it.

• You’ve actually used or broken these frameworks:
  You’ve built real things with Turborepo, Nuxt, Svelte/Svelte Kit, SWR, Workflow, or Nitro (or closely comparable projects), or you’ve found and reported security issues in them.
• You have a deep appreciation and respect for open source work.
• 4+ years in security engineering, ideally with real hands‑on open source contribution experience.
• You’re energized by root cause, not remediation count.
• You can read framework internals, not just application code:
  Strong JavaScript/Type Script fundamentals.
• Pragmatic, not theoretical.
• Vulnerability research chops:
  Experience with structured security assessment methodology.
• Clear communicator.
• Comfortable operating in public.

Demonstrates expertise in vulnerability research and security engineering, with a strong focus on open source frameworks and proactive security measures. Proficient in JavaScript and Type Script, with hands‑on experience in security assessments and community engagement.

• Vulnerability Research
• Security Engineering
• JavaScript/Type Script Fundamentals
• Open Source Contribution
• Structured Security Assessment Methodology

• Vulnerability Assessment
• Framework Internals Analysis
• Preventive Tooling Development
• Root Cause Analysis
• Bug Bounty Program Management

• Clear Communication
• Community Engagement
• Pragmatic Problem Solving

• Vulnerability Disclosure
• CVE Management
• Supply Chain Security
• Open Source Security

• Turborepo
• Nuxt
• Svelte/Svelte Kit
• SWR
• Workflow
• Nitro