My method is very primitive: I have separate physical machines for work and for personal use. And I don't mix the two. The work machine uses my employer's security policy (When I use a freelancing laptop, it is encrypted and uses ubikey for unlocking. I install a new OS for a new job). This way I don't have to worry about visiting not so reputable sites through company VPN or uploading a company document to 4chan accidentally... because these things are just separated as hard as possible.

You need to harden Linux: https://github.com/trimstray/the-practical-linux-hardening-g...

QubesOS?