Senior Web Security Engineer, Browser Platform

Stack

Responsibilities

• ▹Harden agentic browsing and DuckAI experiences against emerging threats (like prompt injection)
• ▹Conduct browser and sync security audits (special pages, DuckAI integrations, password manager, etc.)
• ▹Execute SERP security mitigations: XSS prevention, tooling development for safer code
• ▹Build and maintain harnesses that get security fixes out automatically
• ▹Manage application security scanning infrastructure
• ▹Deliver internal red-team operations (simulated attack scenarios)
• ▹Support security triage

Requirements

• ▹7+ years of experience in web or application security: security assessments, vulnerability research, penetration testing, or secure code review
• ▹Recent experience creating security-focused agentic harnesses
• ▹Experience influencing large feature designs to have security baked in from the start
• ▹Advanced programming or scripting experience with JavaScript
• ▹Bonus: Swift/Kotlin/C#/JavaScript (native apps) or JavaScript/Perl/Go (search)
• ▹Experience with at least one WebView technology (WebKit, WebView2, Chromium WebView) and understanding of browser security models (SOP, CSP, CORS, SameSite cookies)
• ▹Hands-on experience identifying and exploiting web vulnerabilities (XSS, CSRF, injection attacks, authorization flaws)
• ▹Familiarity with security testing tools and frameworks
• ▹Experience partnering with product engineers, advising on security matters
• ▹Experience shaping how an organization thinks about security - driving best practices, improving processes

Soft skills

What we offer

• ▹Transparent compensation - all team members at the same level and region receive the same pay
• ▹$178,500 USD annually and stock options
• ▹Company-sponsored health benefits (US-based team members only)
• ▹Paid parental leave, office setup, and co-working allowances

About the company

DuckDuckGo is the online protection company and remote-first team of 300+ on a mission to raise the standard of trust online. Founded in 2008 and profitable since 2014, annual revenue now exceeds $100m USD. Its browser, search engine, and Duck.ai are used by millions on Mac, Windows, iOS, and Android.