Senior Web Security Engineer, Browser Platform
DuckDuckGoBase Salary
$179k - $179k/yr
Responsibilities
- Execute SERP security mitigations, including XSS prevention and tooling that helps engineers write safer code.
- Set up and maintain application security scanning infrastructure and security-fix automation harnesses.
- Harden agentic browsing and Duck.ai experiences against emerging threats such as prompt injection.
- Conduct browser and sync security audits covering special pages, Duck.ai integrations, and the password manager.
- Perform internal red-team operations involving simulated attack scenarios.
- Support security triage and maintain incident detection and response capabilities.
- Influence feature designs, advise Product Engineers, and improve security practices and processes across teams.
Requirements
- 7+ years of experience in web or application security, including security assessments, vulnerability research, penetration testing, or secure code review.
- Recent experience creating security-focused agentic harnesses.
- Experience influencing large feature designs to incorporate security from the beginning.
- Advanced programming or scripting experience with JavaScript.
- Additional experience with Swift, Kotlin, C#, JavaScript, Java, Perl, or Go is beneficial depending on the product area.
- Understanding of the web security model, including the Same Origin Policy; experience with CSP, CORS, SameSite cookies, sec-fetch-*, CORB, CORP, Sanitizer API, and Trusted Types is beneficial.
- Hands-on experience identifying and exploiting web vulnerabilities such as XSS, CSRF, injection attacks, and authorization flaws.
- Familiarity with security testing tools and frameworks.
- Experience partnering with Product Engineers and helping teams ship secure code faster.
- Experience shaping organizational security practices, improving processes, and raising security standards.
Benefits
- Remote-first team with a flexible work arrangement and no core hours.
- Paid parental leave, office setup support, and co-working allowances.
- Company-sponsored health benefits for eligible team members based in the United States.
- Periodic travel is expected at least twice per year for an all-hands meetup and team retreat, each lasting approximately 4–5 days.
- Average full-time commitment is 40 hours per week.
- Successful candidates must pass a background check.
Tech Stack
Categories
About DuckDuckGo
At DuckDuckGo, we believe the best way to protect your personal information from hackers, scammers, and privacy-invasive companies is to stop it from being collected at all. That's why millions of people choose DuckDuckGo over Chrome and other browsers to search and browse online. Our built-in search engine is like Google but never tracks your searches, and our browser blocks ads, trackers, and cookies that collect your data. It also offers private, useful, and optional AI, including Duck.ai, which lets you chat privately with ChatGPT, Claude, and other AIs, all in one place. Oh, and our browser is free. We make money from privacy-respecting search ads, not by exploiting your data. Take back control of your personal information with the browser designed for data protection, not data collection. Available to download on Mac, Windows, iOS, and Android.