Doctoral student in Web and Emerging Applications Security

Doctoral student in Web and Emerging Applications Security Gothenburg, Sweden 2026-11-27 (Europe/Stockholm) Apply now Save job Create job alert Share this job About the employer Chalmers University of Technology Our goal is to focus on competence, knowledge and collaboration in order to play an important, demonstrable role in social development. Visit the employer page Join a world-leading research environment at the Chalmers Security and Privacy Lab and help shape the future of web, software, and AI security. As a doctoral student, you will contribute to cutting-edge cybersecurity research while working closely with internationally recognized researchers. This position offers an excellent opportunity to develop as an independent researcher and make an impact on secure and trustworthy digital systems. Software is often the root cause of vulnerabilities in modern computing systems. We develop principled concepts and mechanisms to ensure robust security and privacy for software. You will be supervised by Prof. Andrei Sabelfeld (Wallenberg Scholar and recipient of awards from ERC, SSF, VR, WASP, Google, Amazon, Facebook, and OpenAI, as well as the Chalmers Doctoral Supervisor of the Year award). About us The Department of Computer Science and Engineering, a joint department of Chalmers and the University of Gothenburg, spans the breadth of computing disciplines. Our internationally visible research, strong industry links and diverse environment create a collaborative setting where ideas grow into real impact. At the division of Computing Science, we advance secure and trustworthy software and systems, spanning foundations, programming languages, tools and practical methods that help shape dependable digital infrastructures. About the research project You will contribute to one of our research projects on Web and Emerging Applications Security. Our research tracks include: • Web application crawling and security scanning (Black Widow, Black Ostrich, and Spider-Scents) • Security and privacy of browser extensions (FakeX and CodeX) • JavaScript server-side sandboxing (SandTrap) • Data minimization in Trigger-Action Platforms (minTAP and LazyTAP) • Security and privacy of agentic and AI-integrated systems (ongoing research area) Promotional video of our research on securing web applications Who we are looking for The following requirements are mandatory: To qualify as a Doctoral student, you must have a Master's degree (masterexamen) of 120 credits or a Master’s degree (magisterexamen) of 60 credits* in Computer Science, Computer Engineering, Software Engineering, or a closely related field Strong written and verbal communication skills in English Documented research interest and/or achievements in cybersecurity and/or privacy Ability to work independently and analytically to solve complex research problems *for students with an education earned outside of Sweden, a 4-year Bachelor’s degree is accepted. The following experience will strengthen your application: A Master's thesis or research-oriented project in language-based security, web security, or systems security Experience with program analysis, formal methods, or AI/LLM-based systems Publications, open-source security tools, or participation in security competitions (CTFs) and bug bounty programs What you will do Take courses at an advanced level within the Graduate School of Computer Science and Engineering Develop your own scientific concepts and communicate the results of your research verbally and in writing The position generally also includes teaching on Chalmers' undergraduate level or performing other duties corresponding to 20 percent of working hours Conduct research within one of the tracks above Design, implement, and evaluate security analysis tools and prototypes, such as crawlers, scanners, sandboxes, data minimizers, and extension analyzers Publish and present results at cybersecurity venues Contract terms The Doctoral student positions are fully funded from start. The position is a fixed-term appointment of four years, with the possibility to teach up to 20%, which extends the position up to five years. A starting salary of 35,725 SEK per month (valid from May 1, 2026). Doctoral studies require physical presence throughout the entire study period. A valid residence permit must be presented by the study start date; otherwise the admission may be withdrawn. What we offer As a Doctoral student at Chalmers, you are an employee and enjoy all employee benefits. Read more about working at Chalmers and our benefits for employees. A dynamic and inspiring working environment in the coastal city of Gothenburg. Read more about Sweden’s generous parental leave, subsidized day care, free schools, healthcare etc at Move To Gothenburg. Chalmers is dedicated to improving gender balance and actively works with equality projects, such as the GENIE Initiative for gender equality and excellence. We celebrate diversity and consider equality and inclusion as fundamental aspects of all our activities. If Swedish is not your native language, Chalmers offers Swedish courses to help you settle in. Find more general information about doctoral studies at Chalmers here. Application procedure The application should be written in English and attached as PDF-files, as below. Maximum size for each file is 40 MB. Please note that the system does not support Zip files. CV Personal letter A brief introduction about yourself and your track record. A brief motivation as to why you are interested in this position. A brief description of your future goals and research focus. Bachelor’s and, if available, master’s thesis together with the transcripts. Documented evidence of relevant work, if available, such as (links to) research papers, project reports, and software repositories. Use the button at the foot of the page to reach the application form. A background check may be conducted as part of the application process. Please note: The applicant is responsible for ensuring that the application is complete. Incomplete applications and applications sent by email will not be considered. Contact details to references will be requested after the interview. We welcome your application no later than November 27, 2026. For questions, please contact: Professor Andrei Sabelfeld andrei@chalmers.se We look forward to your application! *** Chalmers declines to consider all offers of further announcement publishing or other types of support for the recruiting process in connection with this position. *** Chalmers University of Technology in Gothenburg conducts research and education in technology and natural sciences at a high international level. The university has 3100 employees and 10,000 students, and offers education in engineering, science, shipping and architecture. With scientific excellence as a basis, Chalmers promotes knowledge and technical solutions for a sustainable world. Through global commitment and entrepreneurship, we foster an innovative spirit, in close collaboration with wider society. Chalmers was founded in 1829 and has the same motto today as it did then: Avancez – forward. Read more

Chalmers: Web and emerging application security

Decision summary

Strong but verify fit. This is a software-security doctorate built around principled analysis tools: finding risky data flows, assessing Web application weaknesses, containing third-party JavaScript and minimizing data access. It also offers an emerging agentic/AI-security direction, whose exact project is not yet specified. The post is fully funded from the start, with four years of doctoral employment, extendable to up to five years when teaching occupies up to 20%. Initial pay is SEK 35,725 gross/month, the rate valid from 1 May 2026. The official advert and matching application form available in the 25 October 2026 evidence provide the application route. The deadline is 27 November 2026; the current advert does not specify a closing hour. Current official vacancy

The advert explicitly accepts a four-year bachelor's earned outside Sweden, alongside its relevant master's routes. This matters for China-based applicants, but the actual form has mandatory master's date, subject and thesis-title questions: bachelor-only applicants need HR's truthful completion instructions and formal equivalence assessment, rather than inventing a master's. The work requires physical presence throughout and a valid residence permit by study start, otherwise admission may be withdrawn. Contact Professor Andrei Sabelfeld, andrei@chalmers.se, about a specific track and these arrangements before submitting. Actual application form

Research problem and doctoral work

Modern applications connect browser privileges, databases, third-party modules and external services. Access that is technically possible may be unnecessary for the task or inconsistent with a privacy promise; a tool finding a suspicious flow does not by itself establish a harmful violation. This doctorate studies principles and mechanisms that can make those distinctions useful to developers and reviewers. Information-security foundations; Context-sensitive extension analysis

The appointment contributes to one of five advertised tracks, not all of them:

Track	Named research and the central distinction
Web crawling and security scanning	Black Widow, Black Ostrich, Spider-Scents: reachability/coverage versus a validated vulnerability
Browser-extension security and privacy	FakeX, CodeX: permissions, contextual data flows and credible evidence of privacy behaviour
Server-side JavaScript sandboxing	SandTrap: enforcing boundaries around third-party execution
Trigger-action data minimization	minTAP, LazyTAP: required information versus everything an integration could collect
Agentic and AI-integrated security/privacy	An ongoing research area; model, tools, benchmarks and first work package remain open

Advertised duties are to develop scientific concepts, design, implement and evaluate analysis tools/prototypes, publish and present at security venues, take advanced graduate courses, and undertake teaching/departmental duties. The research objects include crawlers, scanners, sandboxes, data minimizers and extension analyzers. No single named tool is a required skill for every track. Tracks and responsibilities

A possible research question is how an analyzer can present evidence strong enough to distinguish a suspicious information flow from an actual policy breach, while keeping manual verification manageable. Another is how data-minimization principles carry over to agents whose tools and information needs change during a task. These are interpretations supported by the research, not assigned thesis topics or promised results. NIST's 2026 agent initiative highlights authentication, identity and security evaluation as active research/standards work; it does not supply a finished universal standard or prove that this vacancy has a fixed NIST-linked project. Verification problem; Data-access reasoning; Current agent-security research

School, subject and doctoral training

Chalmers is the employing and doctoral institution. The Computer Science and Engineering department is joint with the University of Gothenburg, but that organisational arrangement does not imply a joint/double degree. Computing Science offers an unusually relevant connection between information-flow/Web-security research, programming languages, formal verification and logic. The lab spans software security, privacy, AI security, networks and cryptography; individual co-supervision, datasets and computational resources still need agreement. Joint department; Relevant academic environment; Lab scope

For institutional scope, 2026 ARWU places Chalmers in 301–400 overall. The primary ranking page lists Computer Science and Engineering among ranked subjects but does not show its band in the displayed best-subject table; no CS/cybersecurity rank is inferred. The directly relevant evidence is the group's research record and formal/computational environment, rather than transferring an unrelated subject ranking. Ranking scope; Supervisor publication record

The CSE syllabus specifies a 240-credit doctorate, comprising at least 60 credits of courses and 180 of thesis work, normally an English thesis, and at least two supervisors, one principal. The English qualification title is Doctor of Philosophy in Computer Science and Engineering; admission determines the corresponding Swedish title. Its general foreign-equivalence language must be reconciled with this vacancy's explicit bachelor's footnote. The current appointment and qualification regulations take precedence in any conflict. Expanded syllabus

Chalmers describes four years of full-time doctoral education, typically four to five calendar years with other duties, no doctoral programme fees, and a monthly employment salary. Generic/Transferable Skills training includes 7.5 mandatory credits, with access up to 15; this is not an extra 15-credit requirement on top of the syllabus by assumption. Teaching and other departmental duties cannot exceed 20% under the stated framework. Employment, progress and the individual study plan should preserve sufficient research time. Doctoral structure and conditions

Supervisor and three recent publications

Sabelfeld's current staff page confirms a full professorship in Computing Science and his contact details. The vacancy describes Wallenberg Scholar status, research awards/support and a doctoral-supervisor award. These are useful signals of academic activity, not a measure of every student's experience. The official research record confirms recent conference work across extension analysis, scanning and data minimization. Day-to-day co-supervisor, meeting frequency and first-year expectations are not established. Current staff role; Research continuity

The evidence for the three studies below covers relevant methods, evaluation and limitations; their experiments were not independently reproduced.

1. CodeX, Ahmadpanah, Gobbi, Hedin, Kinder and Sabelfeld, CODASPY 2025. The paper uses contextual static information-flow tracking built on CodeQL for browser extensions. It reports 1,588 extensions with risky flows, with 212 privacy violations among 339 manually checked; those numbers are different categories, not a 100% classifier. The underlying 2021–24 corpus is not a current 2026 prevalence estimate. Policy disclosure, over-approximation, partial modelling and limited data-type coverage require care; encrypted/computed information remains future verification work. The doctoral connection is scalable analysis plus a defensible interpretation of results. Paper, verification and limits

2. Spider-Scents, Olsson, Eriksson, Doupé and Sabelfeld, USENIX Security 2024. Database-aware grey-box analysis studies stored-XSS detection in controlled local application copies. Across 12 applications, reported database coverage was 79–100%, compared with 2–60% for comparison scanners; 85 verified vulnerabilities were found versus 32 from their union. Crucially, unprotected outputs still require contextual verification and are not automatically exploitable. Database access, storage coverage and manual work limit generality; this is not a study of arbitrary public targets. It motivates better validation, not merely more scanner alerts. Evaluation and qualifications

3. LazyTAP, Ahmadpanah, Hedin and Sabelfeld, IEEE S&P 2023. Lazy computation and proxy-based access fetch attributes only when an app execution needs them, with formal correctness/minimization properties. Its 15-app benchmark reports about 95% less data-attribute access than IFTTT and 38% improvement over minTAP. Those are benchmark-specific access reductions, not a universal privacy or speed guarantee. Immutable-object/semantic assumptions and additional communication latency matter; local timing abstracts away real network variability. This provides a principled bridge between implementation, proof and empirical evaluation. Method, assumptions and benchmark

These papers suggest several styles of doctoral work: program modelling, tool engineering, controlled comparative experiments, false-positive/verification analysis and formal reasoning. The selected track determines the balance. A prior publication, a CTF record or proficiency in CodeQL is not made mandatory merely because it appears in this research context.

Qualifications, English and China-based application

Mandatory: a relevant Computer Science, Computer Engineering, Software Engineering or close degree through the 120-credit master's, 60-credit master's, or stated foreign four-year bachelor's route; strong spoken/written English; documented security/privacy research interest and/or achievements; and independent analytical problem-solving. Strengthening experience: a relevant research thesis/project, program analysis/formal methods/AI–LLM work, publications, open-source tools, CTFs or bug bounty participation. These are alternatives/evidence, not a list everyone must complete. Required versus strengthening experience

The university minimum is English B/6, also called English Level 2. Its referenced national guidance gives IELTS Academic 6.5 with no component below 5.5. TOEFL scores depend on test date: 21 January 2026 or later, total 4.5 and no section below 4 on the 1–6 scale; 20 January 2026 or earlier, total 90 and writing 20 on the prior scale. Ask the doctoral administrator how to supply and verify the evidence. Mainland Chinese secondary-school English is insufficient under that guidance; an ordinary mainland English-medium degree/letter is not automatically a listed exemption. Specific recognised prior-study routes exist, but do not assume CET or a generic language letter suffices. Doctoral English reference; Current test and prior-study rules; Mainland-China language context

The China country page is written for master's admission. It is useful for understanding document categories and English evidence; its CSSD/upload instructions are not automatically this doctoral job's application contract. The recruiting department must assess the actual degree and equivalent preparation. The bachelor's footnote remains explicit, while the generic syllabus and master's-only form wording are practical points to settle. Existing master's holders can describe their actual degree normally; bachelor-only applicants should not falsify form fields.

Submit an English CV and personal letter, the bachelor's thesis and undergraduate transcripts, and, if available, the master's thesis with its corresponding transcripts. Relevant papers/reports/repository links may also be included if available. The letter should cover track record, motivation and future goals/research focus. The advert specifies PDF, maximum 40 MB each, no ZIP, even though the generic form lists broader file types. Incomplete and emailed applications are not considered. Referees' contact details are requested after interview, not two initial recommendation letters. A background check may occur. Job-specific documents; Live form limitations

Suggested preparation is a compact research example showing a relevant question, model/threat assumptions, implementation, baseline, reproducibility and limitations, using an authorised test environment. It is a way to evidence research potential, not an additional compulsory exploit, publication or software certificate.

Pay, Gothenburg costs and residence timing

The starting SEK 35,725/month is gross pay, not a stipend/net guarantee; a full twelve months at that unchanged rate is SEK 428,700 gross, an arithmetic scenario rather than a promise about raises or a partial first year. The institutional benefits page describes paid leave and wellness/pension/insurance arrangements, subject to conditions. Generic remote-work allowances do not override this post's physical-presence requirement. Confirm actual teaching allocation, contractual extensions, payroll and individual net income. Funding terms; Employee conditions

Chalmers' general student page publishes SEK 14,360–18,360/month, or SEK 172,320–220,320 for twelve months. This includes SEK 4,000–8,000 housing, food/hygiene of 4,400 and a substantial course-literature allowance. It is a planning scenario, not an employee cost quotation: replace course/insurance/tax lines with actual doctoral circumstances and allow initial travel, deposits, temporary housing and household purchases. Do not subtract it directly from gross pay to advertise savings. The same page's master's tuition language does not override the separate fee-free doctoral policy. Published budget and scope; Doctoral fee rule

Housing guarantees cover specified fee-paying/exchange categories, not all doctoral employees; no guaranteed doctoral room or family apartment is established. Start queues and private/temporary searches early and obtain the actual rent and eligibility. Housing categories and alternatives

For most non-EU applicants, doctoral residence requires final full-time admission, a valid passport and secured maintenance. The 2026 minimum SEK 10,656/month is an immigration test, not this city's full living budget, and accompanying family increases it. The authority can grant up to four years within study/passport validity; a five-year employment arrangement may need an extension. Its complete-case processing commitment is not an individual guarantee. Set the start only after HR/admission and the lawful arrival sequence are clear; valid permission by study start is a material condition of this vacancy. Current doctoral residence requirements

Career evidence and next actions

Program analysis, privacy engineering, secure tooling and rigorous evaluation can support security R&D, product/application security or further academic research. ENISA's skills framework maps twelve professional profiles, but does not promise employment. Its NIS Investments 2025 survey of 1,080 professionals, predominantly large organisations, found persistent attraction/retention problems while investment increasingly favoured technology and outsourcing. This supports relevance, not unlimited internal hiring, Sweden-specific salary or this lab's placement rate. NIST's agent work adds a current research frontier without guaranteeing an AI-only thesis. Role/skills mapping; Workforce evidence and sample limits; Agent-security frontier

Before applying: select a named track and ask Sabelfeld/HR about actual degree/English evidence, the foreign bachelor's form route and closing time. The advert does not establish an exact closing hour; confirm it with the recruiting team.

At interview: resolve the first question, theory/tool/empirical balance, co-supervisor, datasets/test environment, baseline and evaluation standards, available computing, publication expectations, teaching language/time and conference support. Keep AI as an option until its work package is defined.

Before accepting: obtain a realistic start and permit plan, complete admission/degree assessment, background-check/data-access scope, salary/duties and housing arrangements. No explicit nationality exclusion was found in the current vacancy; that is not personal security or residence clearance. The academic opportunity is credible, with the bachelor's/form issue retained as an actionable warning.

Evidence and Sources

Vacancy, institution and doctoral training

• Chalmers Web and Emerging Applications Security vacancy 15156
• Actual Chalmers application form 15156
• Joint Department of Computer Science and Engineering
• CSE graduate school syllabus
• Chalmers doctoral study structure and conditions
• Computing Science information-security environment
• ShanghaiRanking Chalmers 2026

Supervisor, lab and recent papers

• Andrei Sabelfeld official staff profile
• Sabelfeld Chalmers research record
• Chalmers Security and Privacy Lab
• CodeX: Contextual Flow Tracking for Browser Extensions
• Spider-Scents: Grey-box Database-aware Web Scanning for Stored XSS
• LazyTAP: On-Demand Data Minimization for Trigger-Action Applications

English, residence, funding, living costs and careers

• University Admissions: English 6 equivalents
• University Admissions mainland-China guidance
• Swedish Migration Agency doctoral residence route
• Chalmers employee benefits
• Chalmers published student cost scenario 2026
• Chalmers housing guarantees and alternatives
• NIST AI Agent Standards Initiative 2026
• ENISA European Cybersecurity Skills Framework
• ENISA NIS Investments 2025 main report
• CodeX lab-hosted paper