> Markdown version of [/jobs/ext/4709793-senior-web-security-engineer-browser-platform](https://www.wearedevelopers.com/jobs/ext/4709793-senior-web-security-engineer-browser-platform). Every page supports `.md` or `Accept: text/markdown`. Links point to the HTML versions so they work for humans too. Agent guide: [/agents.md](https://www.wearedevelopers.com/agents.md). --- # Senior Web Security Engineer, Browser Platform - **Company:** DuckDuckGo - **Location:** Us, France - **Experience:** Expert - **Salary:** €134,600 - €190,500 - **Contract:** Permanent contract - **Skills:** JavaScript (Programming Language), Application Programming Interfaces (APIs), Artificial Intelligence, Software System Penetration Testing, C Sharp (Programming Language), Computer Programming, Cross-Origin Resource Sharing (Ajax Programming), Cross-Site Request Forgery, Perl (Programming Language), Password Management, Secure Coding, Web Application Security, Scripting, Software Security, Cross-Site Scripting (XSS), Agentic-AI, Kotlin, Vulnerability Analysis - **Published:** November 14, 2026 - **Apply:** https://www.welcometothejungle.com/en/companies/duckduckgo/jobs/senior-web-security-engineer-browser-platform_us_fyrigg75 ## About the Role * 7+ years of experience in web or application security (performing security assessments, vulnerability research, penetration testing, or secure code review) * Recent experience creating security focused agentic harnesses * Experience influencing large feature designs to have security baked in from the start * Advanced programming or scripting experience with JavaScript. Any additional experience with our stack is a bonus: Swift/Kotlin/C#/JavaScript (native apps) or JavaScript/Perl/Go (search). * An understanding of the web security model (such as the Same Origin Policy); experience with CSP, CORS, SameSite cookies, sec-fetch-*, CORB, CORP, Sanitizer API, and Trusted Types is beneficial * Hands-on experience identifying and exploiting web vulnerabilities (XSS, CSRF, injection attacks, authorization flaws, etc.) * Familiarity with security testing tools and frameworks * Experience partnering and collaborating with Product Engineers, advising on security matters and helping teams ship secure code faster * Experience shaping how an organisation thinks about security - driving best practices, improving processes, and raising the bar across teams ## Description Working on the Security Functional Team, you'll play a pivotal role in ensuring our security capabilities keep pace with our rapid product development, including our expanding AI offerings like Duck.ai and agentic browsing, directly protecting our users across all our products. You'll also maintain incident detection and response capabilities for the company, and work on related projects. Recent projects include: * SERP security mitigations * Agentic browsing security mitigations * Agentic browser hardening * Browser and sync security audits As a Senior Security Engineer, App Sec , you'll execute on SERP security mitigations (XSS prevention, tooling development to help engineers write safer code), manage application security scanning infrastructure setup, build and maintain harnesses that get security fixes out automatically, harden our agentic browsing and DuckAI experiences against emerging threats (like prompt injection), conduct browser and sync security audits (special pages, DuckAI integrations, password manager, etc.), deliver on internal red-team operations (simulated attack scenarios), support security triage, and more!, * You'll be required to attend meetings on camera via video conferencing * Expect to travel at least two times a year: once for our all-hands meetup and again for a team retreat (each around 4-5 days). While extenuating circumstances may impact attendance, everyone is strongly encouraged to attend. * While we offer a flexible work arrangement with no core hours, expect an average full-time commitment of 40 hours per week. * A successful candidate must pass a background check as a condition of joining the team. * By applying for this role, you confirm that all information submitted is accurate and complete. You further acknowledge that providing false or fraudulent information during the application process is cause for denial of an offer, revocation of any existing offer, or other adverse action, up to and including termination after the start of your commencement of work. Disclosure Statement: Use of AI in Hiring Process As part of our commitment to enhancing our recruitment process, we utilize artificial intelligence (AI) technology to assist in reviewing and summarizing job applications and test projects, including those tools integrated into our recruitment vendor platforms. We use AI to flag potentially fraudulent applications, analyze and summarize applicants' experience, interviews, and project performance, and help streamline our selection process. Key Principles: * Data Privacy: All information provided in your application will be handled in accordance with our Recruiting Privacy Policy . We ensure that your personal information is protected and used solely for recruitment purposes. * Human Oversight and Accountability: The AI technology is designed to support our hiring team by providing insights and summaries of applications and evaluations of test projects against scoring rubrics. All final evaluations and hiring decisions, however, will be made by our hiring team, who will consider the AI's input alongside other factors. * Transparency: We believe in transparency regarding our hiring practices. If you have any questions about how AI is used in our recruitment process, please feel free to reach out to us.