Senior Web Security Engineer, Browser Platform
DuckDuckGo6 months ago
Remote, United StatesSenior
Base Salary
$179k - $179k/yr
Responsibilities
- Execute SERP security mitigations, including XSS prevention and tooling that helps engineers write safer code.
- Set up and maintain application security scanning infrastructure and security-fix automation harnesses.
- Harden agentic browsing and Duck.ai experiences against emerging threats such as prompt injection.
- Conduct browser and sync security audits covering special pages, Duck.ai integrations, and the password manager.
- Perform internal red-team operations involving simulated attack scenarios.
- Support security triage and maintain incident detection and response capabilities.
- Influence feature designs, advise Product Engineers, and improve security practices and processes across teams.
Requirements
- 7+ years of experience in web or application security, including security assessments, vulnerability research, penetration testing, or secure code review.
- Recent experience creating security-focused agentic harnesses.
- Experience influencing large feature designs to incorporate security from the beginning.
- Advanced programming or scripting experience with JavaScript.
- Additional experience with Swift, Kotlin, C#, JavaScript, Java, Perl, or Go is beneficial depending on the product area.
- Understanding of the web security model, including the Same Origin Policy; experience with CSP, CORS, SameSite cookies, sec-fetch-*, CORB, CORP, Sanitizer API, and Trusted Types is beneficial.
- Hands-on experience identifying and exploiting web vulnerabilities such as XSS, CSRF, injection attacks, and authorization flaws.
- Familiarity with security testing tools and frameworks.
- Experience partnering with Product Engineers and helping teams ship secure code faster.
- Experience shaping organizational security practices, improving processes, and raising security standards.
Benefits
- Remote-first team with a flexible work arrangement and no core hours.
- Paid parental leave, office setup support, and co-working allowances.
- Company-sponsored health benefits for eligible team members based in the United States.
- Periodic travel is expected at least twice per year for an all-hands meetup and team retreat, each lasting approximately 4–5 days.
- Average full-time commitment is 40 hours per week.
- Successful candidates must pass a background check.
Tech Stack
Categories
About DuckDuckGo
DuckDuckGo builds a privacy-focused web search engine and cross-platform browser that blocks trackers for consumers who want less data collection. It makes money primarily from non-tracking search advertising and offers a paid subscription for additional protections. Founded in 2008 and headquartered in Paoli, Pennsylvania, the company has been profitable since 2014 and distributes apps for Mac, Windows, iOS, and Android.