Senior Web Security Engineer, Browser Platform

• Join DuckDuckGo, the online protection company, in a full-time remote-first role. • Work on the Security Functional Team, keeping security capabilities in step with rapid product development. • Protect users across the browser, search and expanding AI offerings such as Duck.ai and agentic browsing. • Harden agentic browsing experiences against emerging threats such as prompt injection. • Maintain incident detection and response capabilities for the company. • Run internal red-team operations and security audits. • Earn $178,500 a year plus stock options, on a transparent pay scale.

• Bring 7+ years of experience in web or application security, covering assessments, vulnerability research, penetration testing or secure code review. • Show recent experience creating security-focused agentic harnesses. • Bring experience influencing large feature designs so security is built in from the start. • Write advanced JavaScript, with programming or scripting depth. • Understand the web security model, including the Same Origin Policy. • Identify and exploit web vulnerabilities such as XSS, CSRF, injection attacks and authorization flaws. • Bring familiarity with security testing tools and frameworks. • Partner with product engineers, advising on security and helping teams ship secure code faster. • Shape how an organisation thinks about security by driving best practices and raising the bar. • Attend video meetings on camera and travel twice a year for the all-hands and a team retreat.

• Bring experience with CSP, CORS, SameSite cookies, sec-fetch headers, CORB, CORP, the Sanitizer API or Trusted Types. • Show experience with Swift, Kotlin or C# for native apps. • Bring experience with Perl or Go on the search side. • Show experience defending against prompt injection in AI products. • Bring experience running red-team operations.

• Execute SERP security mitigations, including XSS prevention and tooling that helps engineers write safer code. • Manage the application security scanning infrastructure. • Build and maintain harnesses that ship security fixes automatically. • Harden agentic browsing and Duck.ai experiences against emerging threats. • Conduct browser and sync security audits across special pages, AI integrations and the password manager. • Deliver internal red-team operations and simulated attack scenarios. • Support security triage across the company.

• Earn $178,500 a year plus stock options. • Benefit from transparent pay, the same for everyone at your level and region. • Work remotely from anywhere on the eligible country list. • Enjoy a flexible arrangement with no core hours, averaging 40 hours a week. • Take paid parental leave. • Get an office setup and co-working allowance. • Attend two company trips a year: an all-hands meetup and a team retreat. • Take full end-to-end ownership of your projects, from scoping to postmortem.

DuckDuckGo is the online protection company and a remote-first team of more than 300 people on a mission to raise the standard of trust online. Founded in 2008 and profitable since 2014, it now earns over $100m in annual revenue, with millions using its browser on Mac, Windows, iOS and Android, its search engine and its subscription. It also offers Duck.ai, which lets people chat privately with ChatGPT, Claude and other AI models.