Senior Web Security Engineer, Browser Platform

Remote. Posted 6 months ago

The role

You will execute SERP security mitigations, manage application security scanning infrastructure, and harden agentic browsing and DuckAI experiences. You will also conduct browser and sync security audits and deliver internal red-team operations.

What you will do

Execute SERP security mitigations
Develop tooling to help engineers write safer code
Manage application security scanning infrastructure setup
Build and maintain harnesses that get security fixes out automatically
Harden agentic browsing and DuckAI experiences against emerging threats
Conduct browser and sync security audits
Deliver internal red-team operations
Support security triage

Required qualifications

7+ years of experience in web or application security
Recent experience creating security focused agentic harnesses
Experience influencing large feature designs to have security baked in from the start
Advanced programming or scripting experience with JavaScript
Hands-on experience identifying and exploiting web vulnerabilities
Familiarity with security testing tools and frameworks
Experience partnering and collaborating with Product Engineers
Experience shaping how an organisation thinks about security

Nice to have

Swift/Kotlin/C#/JavaScript (native apps)
JavaScript/Perl/Go (search)
Experience with CSP, CORS, SameSite cookies, sec-fetch-*, CORB, CORP, Sanitizer API, and Trusted Types

Benefits

Stock options
Paid parental leave
Office setup
Co-working allowances

Before you apply

You will be required to attend meetings on camera via video conferencing
Expect to travel at least two times a year
A successful candidate must pass a background check
By applying, you consent to the use of AI technology in the review process

About the company

DuckDuckGo is an online protection company and remote-first team of 400+ on a mission to raise the standard of trust online. Founded in 2008, it is a profitable company with annual revenue in the hundreds of millions USD.