Senior Software Engineer - Browser Extensions

The Senior Software Engineer - Browser Extensions will own the architecture and implementation of Securly's onboard filtering engine — building a local policy cache and real-time filtering decision engine inside the Chrome extension that moves filtering decisions on-device, improving speed, reliability, and bypass resistance for millions of students on Chromebooks. You will design and build the system that eliminates the cloud round-trip for 80% of filtering decisions: a local policy cache with delta sync, a filtering decision engine running inside the MV3 service worker, and the bypass prevention layer that ensures the security model is not exploitable. Level: L5 Location: Pune, India Work Type: Hybrid (2 days onsite) Reports To: Filter Engineering Manager What You'll Do - Own the architecture of the onboard filtering engine: local policy cache, delta sync protocol, filtering decision engine, and bypass prevention layer. - Architect and implement the local policy cache: delta sync protocol, TTL management, cache invalidation logic, and graceful cloud fallback. - Build the onboard filtering decision engine in the MV3 service worker: domain matching, URL categorization, iframe detection using DOM context, and allow/block decisions. - Implement and harden bypass prevention: same-origin policy, CSP, CORS, iframe sandboxing, content script/page context boundaries, and timing-based attack vectors. - Track Google's Filter and Monitor platform evolution (ChromeOS Content Filtering APIs); write architectural memos evaluating implications for Securly's extension strategy. - Lead the transition and implementation of new filtering features using TypeScript and modern JavaScript within the MV3 framework. - Optimize extension performance to add negligible latency on consumer-grade student Chromebook hardware; define and enforce performance budgets. Skills & Requirements Must-Have - TypeScript & JavaScript mastery - expert-level: async/await, Promises, event-driven architecture, memory management in long-running service workers. - Chrome Extension development (MV3) - deep production experience with Manifest V3, service workers, content scripts, chrome.storage, and declarativeNetRequest / webRequest APIs. - Browser security model - thorough understanding of same-origin policy, CSP, CORS, iframe sandboxing, and the content script/page context boundary. - Security-first architecture - proven ability to enumerate attack surfaces before writing the first line of code. L5 means you define the threat model. - Local caching / offline-first architecture - delta sync, TTL management, cache invalidation design, chrome.storage.local limits, and IndexedDB. - Technical communication - written ADRs, threat model documents, and platform evaluation memos that inform cross-team strategy.