[All remote jobs](https://jobicy.com/jobs.md)Open role[![DuckDuckGo logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/11/ab8415dd5798a360323ce06beaf30c35.png)](https://jobicy.com/company/duckduckgo.md)Remote opportunity at[DuckDuckGo](https://jobicy.com/company/duckduckgo.md) # Senior Web Security Engineer, Browser Platform Review the role, location requirements, compensation details, and application process before deciding whether this opportunity fits your next career move. [Apply for this job](#job-application)[View company](https://jobicy.com/company/duckduckgo.md)Share21 Aug 2026Published21Listing views1Application actions20 Sep 2026Apply before Opportunity details ## About this role. AI SummaryDuckDuckGo is seeking a Senior Web Security Engineer to secure its browser platform, DuckAI integrations, and emerging agentic browsing capabilities. The role focuses on browser and application security audits, mitigation of web vulnerabilities, security automation, scanning infrastructure, red-team exercises, and incident triage. The engineer will partner closely with product teams to embed security into feature design and help developers ship safer code. This remote-first, full-time role requires substantial independent ownership, at least seven years of relevant security experience, and occasional travel for company and team gatherings. ## Role DNA A quick view of the complexity, pace, ownership and collaboration implied by the job description. ### Job Complexity 5/5EasyHard ### Pace & Pressure 4/5RelaxedFast-paced ### Autonomy Level 5/5GuidedFull ownership ### Communication Load 5/5IndependentCollaborative AI insightThis is a senior-level security role involving advanced browser security models, hands-on exploitation, AI/agentic threat mitigation, and organization-wide security influence. The breadth of responsibility across product hardening, red teaming, automation, and incident response makes the technical and strategic demands high. ## Salary analysis Estimated compensation compared with the broader US market for similar roles. Estimated job medianMarket rate$178,500US market range$165k–$220k0$242k AI insightThe posting explicitly offers $178,500 USD annually plus stock options, so the job median is $178,500. For a US-market senior web/application security engineer with browser-platform and AI security responsibilities, a typical estimated base-salary market range is approximately $165,000 to $220,000 USD; equity and benefits may increase total compensation. ## Core skills Skills and capabilities most closely associated with this opportunity. [Web application security](https://jobicy.com/jobs?search_keywords=Web%20application%20security.md)[Browser security](https://jobicy.com/jobs?search_keywords=Browser%20security.md)[Penetration testing](https://jobicy.com/jobs?search_keywords=Penetration%20testing.md)[Secure code review](https://jobicy.com/jobs?search_keywords=Secure%20code%20review.md)[JavaScript](https://jobicy.com/jobs?search_keywords=JavaScript.md)[WebView technologies](https://jobicy.com/jobs?search_keywords=WebView%20technologies.md)[Security automation](https://jobicy.com/jobs?search_keywords=Security%20automation.md)[Red teaming](https://jobicy.com/jobs?search_keywords=Red%20teaming.md)[Incident response](https://jobicy.com/jobs?search_keywords=Incident%20response.md)[AI security](https://jobicy.com/jobs?search_keywords=AI%20security.md) Sample interview questionsHow would you approach securing an agentic browsing feature against prompt-injection attacks?I would first map trust boundaries among web content, user input, model instructions, tools, and privileged browser actions. I would apply least privilege to tools, require explicit user confirmation for sensitive actions, separate untrusted page content from system instructions, and create adversarial test harnesses that continuously evaluate bypass attempts. I would also instrument the feature for detection, safe failure, and rapid remediation of newly observed attack patterns. Describe how you would investigate and mitigate a reflected XSS vulnerability in a search-results page. I would reproduce the issue with a minimal proof of concept, identify the data flow from request input to browser sink, and determine whether output encoding, templating, or DOM manipulation is failing. The primary fix would use context-appropriate output encoding and remove unsafe sink usage rather than relying solely on filtering. I would add regression coverage, assess related endpoints and shared components, and strengthen CSP or trusted-types controls where appropriate. What security considerations are most important when reviewing a WebView-based feature? I would review navigation controls, origin isolation, JavaScript bridge exposure, permission handling, cookie and storage boundaries, and any file or custom-scheme access. I would verify that untrusted content cannot invoke privileged native capabilities and that external navigation, downloads, pop-ups, and redirects are constrained. I would also test platform-specific behavior across WebKit, Chromium WebView, or WebView2 because security defaults and edge cases can differ. How do you influence product engineers to adopt secure designs without slowing delivery unnecessarily? I engage early in design discussions, translate risks into concrete product impact, and offer practical implementation options rather than only identifying problems. I prioritize issues by exploitability and user impact, provide reusable secure patterns and automated checks, and make the secure path the easiest path for engineers. Clear documentation, fast feedback during reviews, and post-incident learning help build trust and improve adoption over time. Give an example of a security automation harness you would build for this role. I would build a CI-integrated harness that exercises browser and DuckAI workflows using adversarial inputs, including prompt-injection payloads, malicious redirects, DOM-based XSS probes, and authorization-boundary tests. The harness would assert that privileged actions require approved conditions and that unsafe content cannot cross trust boundaries. Results would be actionable for product teams, with reproducible artifacts, severity-based alerts, and regression tests added whenever a security defect is fixed. ### Who We Are Hi, we’re DuckDuckGo, the online protection company and remote-first team of 300+ on a mission to raise the standard of trust online. Founded in 2008 and profitable since 2014, annual revenue now exceeds $100m USD and millions use our browser on on [Mac](https://spreadprivacy.com/introducing-duckduckgo-for-mac/), [Windows](https://spreadprivacy.com/windows-browser-open-beta/), [iOS](https://spreadprivacy.com/duckduckgo-privacy-browser-ios14/), and [Android](https://spreadprivacy.com/introducing-app-tracking-protection/), our [search engine](https://duckduckgo.com/), and the [DuckDuckGo subscription](https://duckduckgo.com/pro). We also offer private, useful, and optional AI, including [Duck.ai](https://duck.ai/), which lets you chat privately with ChatGPT, Claude, and other AIs, all in one place. Our [culture](https://duckduckgo.com/how-we-work) of trust, inclusivity, and empowered project management underpins everything we do, where each team member takes full ownership of their projects, from scoping and execution to postmortem. If you’re seeking end-to-end ownership of your work, you’ve come to the right place! ### Your Team and Role Working on the Security Functional Team, you’ll play a pivotal role in ensuring our security capabilities keep pace with our rapid product development, including our expanding AI offerings like Duck.ai and agentic browsing, directly protecting our users across all our products. You’ll also maintain incident detection and response capabilities for the company, and work on related projects. Recent projects include: * Browser and sync security audits * SERP security mitigations * Agentic browser hardening As a Senior Web Security Engineer, Browser Platform, you’ll harden our agentic browsing and DuckAI experiences against emerging threats (like prompt injection), conduct browser and sync security audits (special pages, DuckAI integrations, password manager, etc.), execute on SERP security mitigations (XSS prevention, tooling development to help engineers write safer code), build and maintain harnesses that get security fixes out automatically, manage application security scanning infrastructure setup, deliver on internal red-team operations (simulated attack scenarios), support security triage, and more! ### About You * 7+ years of experience in web or application security (performing security assessments, vulnerability research, penetration testing, or secure code review) * Recent experience creating security focused agentic harnesses * Experience influencing large feature designs to have security baked in from the start * Advanced programming or scripting experience with JavaScript. Any additional experience with our stack is a bonus: Swift/Kotlin/C#/JavaScript (native apps) or JavaScript/Perl/Go (search). * Experience with at least one WebView technology (WebKit, WebView2, Chromium WebView, etc.) and understanding of browser security models (SOP, CSP, CORS, SameSite cookies) * Hands-on experience identifying and exploiting web vulnerabilities (XSS, CSRF, injection attacks, authorization flaws, etc.) * Familiarity with security testing tools and frameworks * Experience partnering and collaborating with Product Engineers, advising on security matters and helping teams ship secure code faster * Experience shaping how an organisation thinks about security – driving best practices, improving processes, and raising the bar across teams ### Compensation $178,500 USD annually and stock options. Compensation is transparent across the organization, and all team members within the same professional level and global region receive the same compensation. Eligibility for company-sponsored health benefits is limited to team members based in the United States. This program does not extend to team members located in other countries, such as Canada or the UK. Our[Team Member Support Guide](https://duckduckgo.com/assets/hiring/team_support_guide.pdf) explains how we prioritize your wellbeing including paid parental leave, office setup, and co-working allowances. ### Hiring Process Hiring works best when it’s a two-way street. Learn how we help you get to know DuckDuckGo, envision your future role here, and find out more about [how we hire](https://duckduckgo.com/how-we-hire). ### Diversity, Equity and Inclusion DuckDuckGo provides equal work opportunities to all team members and applicants, and it prohibits discrimination and harassment of any type on the basis of race, color, ethnicity, caste, religion, age, sex (including pregnancy), national origin, disability status, genetics, protected veteran status, sexual orientation, gender identity or expression, or any other characteristic protected by our policies or federal, state, or local laws. We want to ensure that our hiring process is accessible. If you need reasonable accommodation for any part of the application process because of a medical condition or disability, please send an email to [careers@duckduckgo.com](mailto:careers@duckduckgo.com) to let us know the nature of your request. ### Please note that: * You’ll be required to attend meetings on camera via video conferencing * Expect to travel at least two times a year: once for our all-hands meetup and again for a team retreat (each around 4-5 days). While extenuating circumstances may impact attendance, everyone is strongly encouraged to attend. * While we offer a flexible work arrangement with no core hours, expect an average full-time commitment of 40 hours per week. * A successful candidate must pass a background check as a condition of joining the team. * By applying for this role, you confirm that all information submitted is accurate and complete. You further acknowledge that providing false or fraudulent information during the application process is cause for denial of an offer, revocation of any existing offer, or other adverse action, up to and including termination after the start of your commencement of work. Disclosure Statement: Use of AI in Hiring Process As part of our commitment to enhancing our recruitment process, we utilize artificial intelligence (AI) technology to assist in reviewing and summarizing job applications and test projects, including those tools integrated into our recruitment vendor platforms. We use AI to flag potentially fraudulent applications, analyze and summarize applicants’ experience, interviews, and project performance, and help streamline our selection process. Key Principles: * Data Privacy: All information provided in your application will be handled in accordance with our [Recruiting Privacy Policy](https://duckduckgo.com/static-assets/files/pages/careers/DuckDuckGo-Recruiting-Privacy-Policy-effective-September-30-2025.pdf). We ensure that your personal information is protected and used solely for recruitment purposes. * Human Oversight and Accountability: The AI technology is designed to support our hiring team by providing insights and summaries of applications and evaluations of test projects against scoring rubrics. All final evaluations and hiring decisions, however, will be made by our hiring team, who will consider the AI’s input alongside other factors. * Transparency: We believe in transparency regarding our hiring practices. If you have any questions about how AI is used in our recruitment process, please feel free to reach out to us. By submitting your application, you acknowledge and consent to the use of AI technology in our review process. If you would like to request an alternative selection process, please contact us as at [careers@duckduckgo.com](mailto:careers@duckduckgo.com). Thank you for your interest in joining DuckDuckGo! #LI-DNI Show more [Apply now >](https://jobicy.com/jobs/151281-senior-web-security-engineer-browser-platform.md) * ![Upload CV](data:image/svg+xml;base64,PHN2ZyB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHdpZHRoPSI2NSIgaGVpZ2h0PSI2NSIgZmlsbD0ibm9uZSIgeG1sbnM6dj0iaHR0cHM6Ly92ZWN0YS5pby9uYW5vIj48ZyBjbGlwLXBhdGg9InVybCgjQSkiPjxwYXRoIGQ9Ik0wIDBINjVWNjVIMFYwWiIgZmlsbD0iIzAyOWFlYiIvPjxnIGZpbGw9IiNmZmYiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIyIj48cGF0aCBkPSJNMzMuMDQ5IDE1LjQ1NGExLjQzIDEuNDMgMCAwIDAtMi4wOTcgMGwtNy41NzkgOC4xNDdhMS4zOCAxLjM4IDAgMCAwIC4wOSAxLjk3MyAxLjQ0IDEuNDQgMCAwIDAgMi4wMDgtLjA4OGw1LjEwOS01LjQ5MnYyMC42MWExLjQxIDEuNDEgMCAwIDAgMS40MjEgMS4zOTdjLjc4NSAwIDEuNDIxLS42MjUgMS40MjEtMS4zOTd2LTIwLjYxbDUuMTA5IDUuNDkyYTEuNDQgMS40NCAwIDAgMCAyLjAwOC4wODggMS4zOCAxLjM4IDAgMCAwIC4wOS0xLjk3M2wtNy41NzktOC4xNDZ6TTE2Ljc2OSAzOC40YzAtLjc3My0uNjItMS40LTEuMzg1LTEuNFMxNCAzNy42MjcgMTQgMzguNHYuMTAybC4yMTUgNi4yMjljLjIyMyAxLjY4LjcwMSAzLjA5NSAxLjgxMyA0LjIxOHMyLjUxIDEuNjA3IDQuMTcyIDEuODMzYzEuNi4yMTggMy42MzYuMjE4IDYuMTYuMjE4aDExLjI4bDYuMTYtLjIxOGMxLjY2Mi0uMjI2IDMuMDYxLS43MDkgNC4xNzItMS44MzNzMS41ODktMi41MzggMS44MTMtNC4yMThDNTAgNDMuMTEzIDUwIDQxLjA1NSA1MCAzOC41MDNWMzguNGMwLS43NzMtLjYyLTEuNC0xLjM4NS0xLjRzLTEuMzg1LjYyNy0xLjM4NSAxLjRsLS4xOSA1Ljk1OGMtLjE4MiAxLjM3LS41MTUgMi4wOTUtMS4wMjYgMi42MTJzLTEuMjI4Ljg1My0yLjU4MyAxLjAzOGMtMS4zOTUuMTktMy4yNDMuMTkzLTUuODkzLjE5M0gyNi40NjJjLTIuNjUgMC00LjQ5OC0uMDAzLTUuODkzLS4xOTMtMS4zNTUtLjE4NC0yLjA3Mi0uNTIxLTIuNTgzLTEuMDM4cy0uODQ0LTEuMjQyLTEuMDI2LTIuNjEyYy0uMTg3LTEuNDEtLjE5MS0zLjI3OS0uMTkxLTUuOTU4eiIvPjwvZz48L2c+PGRlZnM+PGNsaXBQYXRoIGlkPSJBIj48cGF0aCBmaWxsPSIjZmZmIiBkPSJNMCAwaDY1djY1SDB6Ii8+PC9jbGlwUGF0aD48L2RlZnM+PC9zdmc+) ### Upload your resume now To unlock remote work opportunities and be discovered by global employers. This job listing has been manually reviewed by the Jobicy Trust & Safety Team for compliance with our posting guidelines, including verification of the company's legitimacy, accuracy of job details, clarity of remote work policy, and absence of misleading or fraudulent content. Next step ## Apply now. Follow the employer’s application method and review Jobicy’s safety guidance before sharing personal information. Keep exploring ## Related remote jobs. Matched by job category10 related opportunities[Cybersecurity](https://jobicy.com/categories/cybersecurity.md) [Browse all jobs](https://jobicy.com/jobs.md) * ![OpenAI logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2023/03/0523b13262b12c215d8009938f5c14f1.jpeg) OpenAI Aug 20 ### [Software Engineer, Security Observability](https://jobicy.com/jobs/151224-software-engineer-security-observability.md) About the Team Security is at the foundation of OpenAI’s mission to ensure that artificial general intelligence benefits all of humanity. The Security team protects OpenAI’s technology, people, and products…. * ![OpenAI logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2023/03/0523b13262b12c215d8009938f5c14f1.jpeg) OpenAI Aug 20 ### [Senior Technical Program Manager – Security](https://jobicy.com/jobs/151221-senior-technical-program-manager-security.md) About the Team OpenAI builds powerful AI systems like ChatGPT, the OpenAI API, and enterprise products that serve millions of users across the globe. As we scale, securing our infrastructure,… * ![Clover Health logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/06/8d4e74b3-221.jpg) Clover Health Aug 19 ### [Director, Governance, Risk, and Compliance (GRC)](https://jobicy.com/jobs/151150-director-governance-risk-and-compliance-grc.md) At Clover, the Business Enablement team leads our technological advancement while ensuring robust security and compliance. We deliver user-friendly corporate applications, manage complex data ecosystems, and provide efficient tech solutions… * ![Synthesia logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/06/c69aad11-221.webp) Synthesia Aug 19 ### [Application Security Engineering Manager](https://jobicy.com/jobs/146803-application-security-engineering-manager.md) Synthesia is the world’s leading AI video platform for business, used by over 90% of the Fortune 100. Founded in 2017, the company is headquartered in London, with offices and… * ![Figma logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2020/10/WRILS-201016160957-035844.png) Figma Aug 18 ### [Security Engineer](https://jobicy.com/jobs/151026-security-engineer.md) Figma is growing our team of passionate creatives and builders on a mission to make design accessible to all. Figma’s platform helps teams bring ideas to life—whether you’re brainstorming, creating… * ![Clickhouse logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2025/08/6394b9a0-221.png) Clickhouse Aug 18 ### [Security Specialist – EMEA (location flexible)](https://jobicy.com/jobs/150995-security-specialist-emea-location-flexible.md) About ClickHouse Recognized on the 2025 Forbes Cloud 100 list, ClickHouse is one of the most innovative and fast-growing private cloud companies. With more than 4,000 customers and ARR that… * ![Experian logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/09/dcc5b29a570bb19b9f5c3e150db2fdfe.jpg) Experian Aug 18 ### [Cyber Defense Senior Analyst](https://jobicy.com/jobs/146651-cyber-defense-senior-analyst.md) Company DescriptionExperian is a global data and technology company, powering opportunities for people and businesses around the world. We help to redefine lending practices, uncover and prevent fraud, simplify healthcare,… * ![Nebius logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/06/d90c0566-221.webp) Nebius Aug 18 ### [Application Security Engineer](https://jobicy.com/jobs/146769-application-security-engineer-2.md) About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from… * ![Experian logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2021/09/dcc5b29a570bb19b9f5c3e150db2fdfe.jpg) Experian Aug 18 ### [Cyber Defense Senior Analyst](https://jobicy.com/jobs/149401-cyber-defense-senior-analyst-2.md) Company DescriptionExperian is a global data and technology company, powering opportunities for people and businesses around the world. We help to redefine lending practices, uncover and prevent fraud, simplify healthcare,… * ![Nebius logo](https://jobicy.com/data/server-nyc0409/galaxy/mercury/2026/06/d90c0566-221.webp) Nebius Aug 17 ### [Vulnerability Operation Center Lead](https://jobicy.com/jobs/149362-vulnerability-operation-center-lead.md) About Nebius: Nebius is leading a new era in cloud infrastructure for the global AI economy. We are building a full-stack AI cloud platform that supports developers and enterprises from…