Senior Software Engineer (Browser Automation)

Join our team as a Senior Software Engineer specializing in browser automation. You will be responsible for developing and enhancing our autonomous web application penetration testing tool. Your work will involve tackling the complexities of modern web applications, improving crawl coverage and throughput, and collaborating with attack-team engineers. This is a remote position with opportunities for career advancement, a culture of innovation, and a commitment to diversity and inclusion.

• Contribuer à la croissance et au renforcement de notre moteur d'automatisation des navigateurs et de crawling, qui est la couche qui découvre, navigue et interagit avec les applications cibles avant et pendant un test de pénétration autonome.
• Améliorer la couverture, la déterminisme et le débit du crawl, ce qui implique la découverte des points de terminaison et des paramètres, la dé-duplication, la mise en file d'attente et la gestion de l'état, tout en gardant tout en sécurité de production et conscient des effets secondaires.
• Collaborer avec les ingénieurs de l'équipe d'attaque qui consomment votre sortie de crawl, et aider à façonner la carte d'application basée sur le graphe dont le reste du pipeline dépend.
• Ownership mentality: you are comfortable taking a critical subsystem from "works" to "works unattended, at scale, against someone else's production environment."
• Background in web application security or offensive tooling — familiarity with broken access control, IDOR/BOLA, SQLi, XSS, SSRF, or SSTI in the wild
• You have battle-tested experience with LLMs in production. You understand the engineering trade-offs: knowing when AI is an asset and when it introduces unacceptable latency or nondeterminism compared to a deterministic script
• Experience with agentic browser frameworks (Stagehand, Browser Use, or similar) or building LLM-in-the-loop automation
• Experience with large-scale crawling, endpoint discovery (e.g., parsing/analyzing client-side JS), or session/credential management for automated access
• A track record of taming flaky, stateful, JavaScript-heavy apps. You've fought SPA timing, authentication, and anti-automation defenses and won
• Experience building production software, with deep, hands-on experience in browser automation (Playwright, Puppeteer, or Selenium) against real, non-trivial web applications
• A bias toward determinism and debuggability, and the judgment to reach for an LLM only when a deterministic approach genuinely can't do the job
• Comfort working in an environment where correctness against a live customer system is a hard, non-negotiable constraint
• You’ve built browser automation at extreme scale, handling thousands of sessions against hostile, heavily-defended targets. You know exactly how systems break under pressure and have the war stories to prove it
• Solid instincts for distributed/concurrent systems: queues, backpressure, retries, idempotency, and running many browser sessions reliably at scale
• Strong TypeScript / Node.js skills and comfort living inside the headless-browser stack, including Chromium internals, the Chrome DevTools Protocol, network interception, the DOM, and JS execution contexts
• You’ve gone beyond using tools like Playwright or Puppeteer to actually hacking on their internals or contributing to the core
• You’ve successfully outmaneuvered sophisticated WAFs, anti-bot defenses, and fingerprinting mechanisms in production environments
• Familiarity with graph data models (e.g., Neo4j) for representing application structure
• You have an offensive security mindset: you don’t just navigate a web app; you actively map its attack surface and hunt for unreachable paths