Job description
Request for Proposals: Security Software Developer (Contract)
Freedom of the Press Foundation (FPF) is seeking a contract security software developer for a six-month engagement (approximately 30 hours per week), with the possibility of renewal. This role will contribute to the development of the WEBCAT browser extension, a security-focused tool to provide code integrity in the browser environment.
This role involves a mix of hands-on implementation and applied security research, including engagement with emerging standards and proposals related to web integrity.
This role is fully remote. Candidates may be in any time zone, but we prefer availability for communication during afternoon work hours (1-6 p.m. U.S. Eastern time).
Scope of work
In coordination with FPF’s engineering manager (SecureDrop), the contractor will:
- Implement security-sensitive components of the WEBCAT browser extension.
- Analyze and provide feedback to draft specifications for code integrity and transparency in the browser context, as well as potentially author or co-author technical proposals.
- Work independently and communicate progress in regular check-ins with other FPF engineering staff.
- Collaborate with other engineers and researchers at FPF and externally to identify and mitigate security threats.
Desired qualifications:
- Deep understanding of web application security principles (e.g., XSS attack mitigation) and browser security models (e.g., Same-Origin Policy, Content Security Policy, etc.).
- Demonstrated adversarial thinking; prior experience auditing or participating in Capture The Flag (CTF) competitions is a plus.
- Hands-on software development expertise.
- Experience across the software development life cycle: building, testing, shipping, and releasing code into production.
- Comfort working in open source development.
Preferred familiarity with:
- WebAssembly
- JavaScript/TypeScript
- Web browser extension APIs
Nice-to-have:
- Rust
Term of contract
This is a part-time, hourly contract. The contract will commence on a mutually agreeable date no later than Mar 1, 2026, for an initial duration of six months.
Payments and schedule
The contractor will be paid at a rate of USD $80-85 per hour, up to 30 hours per week, invoiced monthly. The contractor will be solely responsible for paying any and all taxes incurred as a result of their compensation.
FPF’s WEBCAT meetings currently take place Thursdays, 1 p.m. U.S. Eastern time; we are flexible in negotiating the overlap of time for follow-ups beyond that.
In your response to this RFP, please provide:
- A brief statement of interest (one-page maximum), which includes your availability (hours per week and any known constraints). Please do so by uploading this as an attachment in the space designated “cover letter”.
- Relevant experience or examples of prior work (GitHub, write-ups, audits, etc.).
- A CV/resume.
