Senior Software Engineer - Browser Extension İş İlanı

DefensX's browser extension enforces security policy directly in the browser — content filtering, phishing detection, credential protection, data-loss-prevention style content inspection, and AI-tool interaction safeguards. It runs with broad permissions across every page a user visits, on Chrome, Edge, and Firefox, across both Manifest V2 and V3 — which makes it one of the highest-stakes codebases in the company: a mistake here isn't a bug, it's a security bypass or a data leak. What you'll work on - Security-critical logic that runs on every page load, in a codebase where correctness and performance are equally non-negotiable. - Cross-context message security: content scripts, the background service worker, and trusted external origins all pass messages to each other — every boundary needs strict validation, and this is the area we weight most heavily in review. - MV3 service worker constraints: designing for an ephemeral, event-driven background context with no persistent in-memory state, while maintaining a parallel MV2 build in production. - Native/WASM-backed detection engines integrated into the extension for content and threat inspection — you'll consume and integrate these at the JS/WASM boundary. - Multi-target build engineering: a single build pipeline producing genuinely different bundles per browser and per manifest version. - An incrementally-adopted TypeScript migration — new work is TypeScript, in a codebase that's still majority JavaScript today. Tech stack - Environment: browser platform (Chrome/Edge/Firefox — MV2 and MV3 both actively shipped), Node.js for tooling/build - Extension code: JavaScript (majority) and TypeScript (all new work), HTML/CSS - UI: React, used in a bounded set of surfaces (settings/dashboard UI, toolbar popup, internal tooling). Most of the extension's actual enforcement logic is vanilla JS/TS, not React. - Build: Webpack, multi-target (per-browser × per-manifest-version bundles), TypeScript build integration What we're looking for - Strong JavaScript/TypeScript, and real comfort with the browser as a platform: the DOM, event ordering, page load lifecycle, same-origin rules, CSP. - Hands-on browser extension experience (Manifest V3 especially; MV2 experience is directly useful here, not just "a plus," since we maintain both). - Security instincts: you think about what an attacker or a hostile page can do with the code you just wrote — this is a daily concern here, not a checklist item. - Comfort with build tooling (Webpack, multi-target builds, TypeScript build integration). Nice to have - WASM, Emscripten, or C interop experience. - Familiarity with web security / secure web gateway / DLP / ZTNA products. - Experience with performance work on code that runs on every single page load.