Senior Web Security Engineer, Browser Platform
Duck Duck Go · Remote
About this role
## DuckDuckGo — Senior Web Security Engineer, Browser Platform ### About DuckDuckGo DuckDuckGo is an online protection company and a remote-first team of 400+ people on a mission to raise the standard of trust online. Founded in 2008 and profitable since 2014, millions use DuckDuckGo across browser and mobile products, search, and subscription offerings. ### Team & Role You’ll join the **Security Functional Team** and help ensure DuckDuckGo’s security capabilities keep pace with rapid product development—including expanding **AI offerings** (e.g., Duck.ai) and **agentic browsing**. You’ll also maintain **incident detection and response** capabilities and work on related security projects. **Recent work includes:** - SERP security mitigations - Agentic browsing security mitigations - Agentic browser hardening - Browser and sync security audits ### What You’ll Do As a **Senior Security Engineer (AppSec)**, you will: - Execute on **SERP security mitigations** (including **XSS prevention**) - Develop tooling to help engineers write safer code - Set up and manage **application security scanning infrastructure** - Build and maintain **harnesses** that help security fixes ship automatically - Harden **agentic browsing** and **DuckAI** experiences against emerging threats (e.g., **prompt injection**) - Conduct **browser and sync security audits** (e.g., special pages, DuckAI integrations, password manager) - Deliver on **internal red-team** operations (simulated attack scenarios) - Support **security triage** and related efforts ### About You - **7+ years** of experience in web/application security (assessments, vulnerability research, pentesting, or secure code review) - Recent experience creating **security-focused agentic harnesses** - Ability to influence large feature designs so security is built in from the start - Advanced **JavaScript** (or scripting) skills - Strong understanding of the **web security model** (e.g., Same Origin Policy) and familiarity with concepts/tools such as **CSP, CORS, SameSite cookies, sec-fetch-***, **CORB/CORP**, **Sanitizer API**, and **Trusted Types** - Hands-on experience identifying and exploiting web vulnerabilities (e.g., **XSS, CSRF, injection, authorization flaws**) - Familiarity with security testing tools and frameworks - Experience partnering with Product Engineers to advise and help teams ship securely - Experience shaping how an organization thinks about security (best practices, process improvements, raising the bar) ### Compensation Paid on a regional pay scale (local currency) with **stock options**: - **United States:** $190,500 USD annually - **United Kingdom:** £134,600 GBP annually - **Canada:** C$253,500 CAD annually - **Europe/Rest of World:** €157,350 EUR annually Notes: - In **Spain**, pay is expected to transition to the EUR scale on **Jan 1, 2027**; in other Europe/Rest of World countries on **Feb 1, 2027**. - Compensation is transparent by professional level and global region. - US-based team members may be eligible for company-sponsored health benefits. ### Hiring Process (Highlights) - Hiring is a two-way street—learn how DuckDuckGo helps you understand the role and how they hire: https://duckduckgo.com/how-we-hire ### Important Notes - You’ll be required to attend meetings **on camera** via video conferencing - Expect to travel **at least 2 times/year** (all-hands meetup + team retreat; ~4–5 days each) - Flexible work arrangement with **no core hours**, but expect ~**40
Listing freshness
CronJobs last confirmed this listing 2h ago. If its source stops confirming the opening for seven days, this page is removed from active inventory.