From the listing
About the role
DuckDuckGo is the online protection company and remote-first team of 400+ on a mission to raise the standard of trust online. Founded in 2008 and profitable since 2014, millions use our browser on Mac, Windows, iOS, and Android, and our search engine.
Working on the Security Functional Team, you'll play a pivotal role in ensuring security capabilities keep pace with rapid product development, including expanding AI offerings like Duck.ai and agentic browsing. You'll also maintain incident detection and response capabilities for the company.
Our culture of trust, inclusivity, and empowered project management underpins everything we do, where each team member takes full ownership of their projects, from scoping and execution to postmortem.
What you'll do
- Execute on SERP security mitigations including XSS prevention and tooling development.
- Manage application security scanning infrastructure setup.
- Build and maintain harnesses that get security fixes out automatically.
- Harden agentic browsing and DuckAI experiences against emerging threats like prompt injection.
- Conduct browser and sync security audits for special pages, DuckAI integrations, and password managers.
- Deliver on internal red-team operations and simulated attack scenarios.
- Support security triage and advise product engineers on security matters.
What they're looking for
- 7+ years of experience in web or application security.
- Recent experience creating security focused agentic harnesses.
- Experience influencing large feature designs to have security baked in from the start.
- Advanced programming or scripting experience with JavaScript.
- Understanding of the web security model including Same Origin Policy, CSP, CORS, and Sanitizer API.
- Hands-on experience identifying and exploiting web vulnerabilities such as XSS, CSRF, and injection attacks.
- Familiarity with security testing tools and frameworks.
- Experience driving security best practices and raising the bar across teams.
Nice to have
- Experience with Swift, Kotlin, C#, Perl, or Go.
From the company page
DuckDuckGo benefits
◉ Remote policy · in their words
“Remote First, Always: We've always been a fully distributed company with team members all over the world. We trust you to get your work done wherever, and whenever.”
Pulled from their careers page · verified by Atlas
The hot takeJeff's read on DuckDuckGo
DuckDuckGo has the only perfect score in our database, and is THE prototype for what we look for in a work-from-anywhere company. Well, not JUST a WFA company, but ANY company. Here's the core tenets we look for:
- Clear prioritization of working from anywhere as a business model.
- Clear expression of trust and empowerment for employees.
- Understanding that output > location or hours.
- Transparent perk package.
- Transparent salary offering per role.
- Emphasis of employees over mission statement.