# Senior Web Security Engineer, Browser Platform - **Company:** [DuckDuckGo](/companies/duckduckgo) - **Location:** United States - **Type:** remote - **Posted:** Aug 18, 2026 - **Views:** 5 **Keywords:** csharp, javascript, kotlin, perl, swift ## Summary DuckDuckGo, a profitable online privacy company with 300+ remote-first employees, is hiring a Senior Web Security Engineer for its Browser Platform. The role focuses on hardening agentic browsing and DuckAI against threats like prompt injection, conducting browser/sync security audits, and building security tooling. Requires 7+ years in web/application security, advanced JavaScript skills, and experience with WebView technologies and browser security models. Salary is $178,500 USD annually plus stock options, with a fully remote US-based role. --- ## Job Description <h2><strong>Who We Are</strong></h2> <p>Hi, we're DuckDuckGo, the online protection company and remote-first team of 300+ on a mission to raise the standard of trust online. Founded in 2008 and profitable since 2014, annual revenue now exceeds $100m USD and millions use our browser on on <a href="https://spreadprivacy.com/introducing-duckduckgo-for-mac/" rel="nofollow">Mac</a>, <a href="https://spreadprivacy.com/windows-browser-open-beta/" rel="nofollow">Windows</a>, <a href="https://spreadprivacy.com/duckduckgo-privacy-browser-ios14/" rel="nofollow">iOS</a>, and <a href="https://spreadprivacy.com/introducing-app-tracking-protection/" rel="nofollow">Android</a>, our <a href="https://duckduckgo.com/" rel="nofollow">search engine</a>, and the <a href="https://duckduckgo.com/pro" rel="nofollow">DuckDuckGo subscription</a>. We also offer private, useful, and optional AI, including <a href="https://duck.ai/" rel="nofollow">Duck.ai</a>, which lets you chat privately with ChatGPT, Claude, and other AIs, all in one place. Our <a href="https://duckduckgo.com/how-we-work" rel="nofollow">culture</a> of trust, inclusivity, and empowered project management underpins everything we do, where each team member takes full ownership of their projects, from scoping and execution to postmortem. If you're seeking end-to-end ownership of your work, you've come to the right place!</p> <h2><strong>Your Team and Role</strong></h2> <p>Working on the Security Functional Team, you'll play a pivotal role in ensuring our security capabilities keep pace with our rapid product development, including our expanding AI offerings like Duck.ai and agentic browsing, directly protecting our users across all our products. You'll also maintain incident detection and response capabilities for the company, and work on related projects. Recent projects include:</p> <ul> <li> <p>Browser and sync security audits</p> </li> <li> <p>SERP security mitigations</p> </li> <li> <p>Agentic browser hardening</p> </li> </ul> <p>As a <strong>Senior Web Security Engineer, Browser Platform</strong>, you'll harden our agentic browsing and DuckAI experiences against emerging threats (like prompt injection), conduct browser and sync security audits (special pages, DuckAI integrations, password manager, etc.), execute on SERP security mitigations (XSS prevention, tooling development to help engineers write safer code), build and maintain harnesses that get security fixes out automatically, manage application security scanning infrastructure setup, deliver on internal red-team operations (simulated attack scenarios), support security triage, and more!</p> <h2><strong>About You</strong></h2> <ul> <li> <p>7+ years of experience in web or application security (performing security assessments, vulnerability research, penetration testing, or secure code review)</p> </li> <li> <p>Recent experience creating security focused agentic harnesses</p> </li> <li> <p>Experience influencing large feature designs to have security baked in from the start</p> </li> <li> <p>Advanced programming or scripting experience with JavaScript. Any additional experience with our stack is a bonus: Swift/Kotlin/C#/JavaScript (native apps) or JavaScript/Perl/Go (search).</p> </li> <li> <p>Experience with at least one WebView technology (WebKit, WebView2, Chromium WebView, etc.) and understanding of browser security models (SOP, CSP, CORS, SameSite cookies)</p> </li> <li> <p>Hands-on experience identifying and exploiting web vulnerabilities (XSS, CSRF, injection attacks, authorization flaws, etc.)</p> </li> <li> <p>Familiarity with security testing tools and frameworks</p> </li> <li> <p>Experience partnering and collaborating with Product Engineers, advising on security matters and helping teams ship secure code faster</p> </li> <li> <p>Experience shaping how an organisation thinks about security - driving best practices, improving processes, and raising the bar across teams</p> </li> </ul> <h2><strong>Compensation</strong></h2> <p><strong>$</strong> <em><strong>178,500</strong></em> <strong>USD annually</strong> and stock options. Compensation is transparent across the organization, and all team members within the same professional level and global region receive the same compensation.</p> <p>Eligibility... --- ## Apply [Apply for this position](https://4dayweek.io/job/senior-web-security-engineer-browser-platform-at-duckduckgo-2d0efb9a) --- ## About DuckDuckGo - **Website:** [https://4dayweek.io](https://4dayweek.io)

4dayweek.io is a job board dedicated to helping job seekers find roles at companies committed to better work-life balance, including 4-day weeks, 9-day fortnights, flexible schedules, and more. The platform lists thousands of jobs and verifies each company's schedule policy. It also offers an Auto Apply feature (JobCopilot) that auto-applies to jobs on behalf of users. The site features companies like &samhoud, 25hours Hotels, AFAS Software, and AWIN, and provides resources on the pros and cons of reduced-hour work weeks.

[View company profile →](/companies/duckduckgo)