Senior Web Security Engineer

Responsibilities

• Conduct browser security audits for special pages, DuckAI integrations, and password managers
• Execute SERP security mitigations including XSS prevention and tooling development
• Manage application security scanning infrastructure setup (SAST/DAST integrations in GitHub)
• Deliver internal red-team operations through simulated attack scenarios
• Support security triage and incident detection/response capabilities
• Partner with Product Engineers to advise on security and help ship secure code

Requirements

• 7+ years of experience in web or application security
• Advanced programming or scripting experience with JavaScript
• Experience with WebView technologies (WebKit, WebView2, Chromium WebView, etc.)
• Deep understanding of browser security models (SOP, CSP, CORS, SameSite cookies)
• Hands-on experience identifying and exploiting web vulnerabilities (XSS, CSRF, injection, etc.)
• Familiarity with security testing tools and frameworks
• Experience driving security best practices and improving organizational processes

Preferred Qualifications

• Experience with Swift, Kotlin, C#, Perl, or Go

About the Company

DuckDuckGo is an online protection company and remote-first team on a mission to raise the standard of trust online. Founded in 2008, we offer a private search engine, browser, and optional private AI tools.