Senior Software Engineer - Browser Extensions

The Senior Software Engineer - Browser Extensions will own the architecture and implementation of Securly's onboard filtering engine — building a local policy cache and real-time filtering decision engine inside the Chrome extension that moves filtering decisions on-device, improving speed, reliability, and bypass resistance for millions of students on Chromebooks.

You will design and build the system that eliminates the cloud round-trip for 80% of filtering decisions: a local policy cache with delta sync, a filtering decision engine running inside the MV3 service worker, and the bypass prevention layer that ensures the security model is not exploitable.

At L5, this role carries additional strategic weight. Google's Filter and Monitor platform shift is moving ChromeOS toward native Content Filtering APIs and away from browser extensions as the primary enforcement point. You will track this transition, evaluate its implications for Securly's extension strategy, and surface architectural recommendations — not just implement the current plan.

• Own the architecture of the onboard filtering engine: local policy cache, delta sync protocol, filtering decision engine, and bypass prevention layer.
• Architect and implement the local policy cache: delta sync protocol, TTL management, cache invalidation logic, and graceful cloud fallback.
• Build the onboard filtering decision engine in the MV3 service worker: domain matching, URL categorization, iframe detection using DOM context, and allow/block decisions.
• Implement and harden bypass prevention: same-origin policy, CSP, CORS, iframe sandboxing, content script/page context boundaries, and timing-based attack vectors.
• Track Google's Filter and Monitor platform evolution (ChromeOS Content Filtering APIs); write architectural memos evaluating implications for Securly's extension strategy.
• Lead the transition and implementation of new filtering features using TypeScript and modern JavaScript within the MV3 framework.
• Optimize extension performance to add negligible latency on consumer-grade student Chromebook hardware; define and enforce performance budgets.
• Mentor Ashish M (L4) and new extension hires: substantive code reviews, pair on security model design, drive team understanding of bypass threat vectors.
• Manage chrome.storage.local within platform limits; evaluate IndexedDB for policy cache requirements that exceed those limits.

• You know how browsers actually work — not just the APIs, but the security model, the process model, and the specific ways students try to break it.
• You have shipped production Chrome extensions at scale and know what service worker memory management means on a 4GB Chromebook.
• You track platform shifts (Google F&M, ChromeOS Content Filtering API) and understand what they mean for your system's architecture.
• You produce written artifacts (ADRs, threat models, platform memos) that document your reasoning for the team and for leadership.
• You write TypeScript that other senior engineers learn from, and your code reviews raise the floor for the engineers around you.

L5 at Securly is a Staff Engineer. You are the technical owner, not just an implementer.

• Drive technical direction for your initiative end-to-end: from architecture to production, with minimal oversight from your engineering manager.
• Identify and resolve ambiguity in requirements, system boundaries, and design tradeoffs without waiting for a fully-formed spec.
• Mentor L3/L4 engineers on the team: code reviews, design feedback, pairing, and raising the bar for what production-quality work looks like.
• Partner with your L6 technical lead and the Distinguished Engineer on architectural decisions, surfacing tradeoffs clearly rather than deferring them upward.
• Contribute to cross-team engineering standards: you are expected to influence practices beyond your immediate squad.
• Translate technical context into clear written artifacts that non-engineers (PM, Support, Leadership) can act on.
• Participate in on-call rotation and own the full incident lifecycle for your system: detection, diagnosis, resolution, and retrospective.