Senior Web Security Engineer, Browser Platform

Duck Duck Go
Anywhere
Workplace: RemoteFull timeUSD 178,500+ annuallyFunction: CybersecuritySkills: ["Ownership","Collaboration","Process improvement","Security triage"]

Ensure DuckDuckGo’s security capabilities keep pace with rapid product development by conducting browser security audits and implementing SERP security mitigations. You’ll set up and integrate app security scanning (SAST/DAST via GitHub), support incident detection and security triage, and lead internal red-team operations. Partner closely with product engineers to advise on security best practices and help teams ship safer code faster.

Loading

Loading job details...

Preparing the role view and application actions.

FursaFursa
Duck Duck Go
Duck Duck Go
8 months ago

Senior Web Security Engineer, Browser Platform

✓ Verified Job

Canonical indexed version, validated from employer's careers page.

Source: Company careers pageValidated by: Fursa AI
Last checked: 22 hours agoStatus: Live

Job Summary

Ensure DuckDuckGo’s security capabilities keep pace with rapid product development by conducting browser security audits and implementing SERP security mitigations. You’ll set up and integrate app security scanning (SAST/DAST via GitHub), support incident detection and security triage, and lead internal red-team operations. Partner closely with product engineers to advise on security best practices and help teams ship safer code faster.
Location: Anywhere
Workplace: Remote
Employment Type: Full time
Job Function: Cybersecurity
Seniority: Mid level

Key Responsibilities

  • •Conduct browser security audits across special pages and DuckAI integrations (including password manager).
  • •Execute SERP security mitigations such as XSS prevention and develop tooling to help engineers write safer code.
  • •Set up application security scanning infrastructure by integrating SAST/DAST with GitHub.
  • •Deliver internal red-team operations by running simulated attack scenarios and supporting security triage.
  • •Partner with product engineers to advise on security matters, improving processes and raising security best practices across teams.
Travel: Low travel

Pay and Benefits

Salary: USD 178,500 annually
Equity and Bonus:Equity
Perks:Parental LeaveOffice Setup

Key Requirements

  • •7+ years of experience in web or application security, including security assessments, vulnerability research, penetration testing, or secure code review.
  • •Advanced programming or scripting experience with JavaScript, with additional experience across Swift, Kotlin, C#, JavaScript (native apps), or JavaScript/Perl/Go (search) as a bonus.
  • •Experience with WebView technology (WebKit, WebView2, Chromium WebView, etc.) and understanding browser security models such as SOP, CSP, CORS, and SameSite cookies.
  • •Hands-on ability to identify and exploit web vulnerabilities including XSS, CSRF, injection attacks, and authorization flaws.
  • •Familiarity with security testing tools and frameworks, and experience collaborating with product engineers on security matters.
Experience:Web securityApplication securityBrowser securityPenetration testing
Skills:OwnershipCollaborationProcess improvementSecurity triage
Tech Stack:JavaScriptSwiftKotlinC#PerlGoWebKitWebView2Chromium WebViewGitHubSASTDASTXSSCSRFCORSCSPSOPSameSite cookies

Company Brief

Duck Duck Go
Privacy-focused internet company that provides the DuckDuckGo search engine, browser, and privacy tools which block tracking and avoid user profiling while monetizing via privacy-respecting ads and affiliate programs.
Industry: Cybersecurity
Company Size: Medium (51 to 250 employees)
Growth: Scaleup
Funding: Series D
Headquarters: Paoli, United States
Founded: 2008
Glassdoor
Glassdoor: 4.4
WebsiteLinkedInGlassdoor