Senior Security Engineer - Pentester

The role

This person will conduct penetration testing of product features and multi-cloud infrastructure. They will review cloud configurations, triage bug bounty submissions, and use AI tools to automate security tasks.

What you will do

• Conduct deep-dive penetration tests of products across a multi-cloud (AWS & GCP) environment.
• Review IAM policies, service configurations, and cloud-native permission structures.
• Execute dynamic testing against web interfaces and API endpoints.
• Assess the security posture of hybrid infrastructure spanning containers and virtual machines.
• Triage findings, build proofs-of-concept, and partner with product teams for remediation.
• Use AI and large language models to automate reconnaissance, generate attack vectors, and draft reports.
• Monitor bug bounty pipelines and external reports.

Required qualifications

• Deep architectural understanding of GCP and AWS.
• Experience auditing and hardening managed container services (GKE Autopilot/Standard, EKS, ECS) and self-hosted/unmanaged workloads (K8s, k3s, OCI-runc).
• Ability to integrate AI/LLM tools into the pentesting lifecycle.
• Expert-level knowledge of web application security principles and offensive testing methodologies.
• Proficiency in OWASP Top 10 vulnerabilities, modern web framework exploitation, and API security (REST, WebSockets).
• Hands-on experience conducting manual security assessments using Burp Suite Professional, OWASP ZAP, or similar tooling.
• Understanding of browser security mechanisms (CSP, CORS, SameSite cookies, Subresource Integrity).
• Understanding of secure authentication/authorization patterns (OAuth 2.0, OIDC, JWT).
• Understanding of security header configurations (HSTS, X-Frame-Options, Permissions-Policy).
• Proficiency in Python, Go, or Bash.
• Solid grasp of Terraform and cloud-native deployment patterns.
• Ability to write high-quality technical reports.

Nice to have

• Experience with Gatekeeper policies and Binary Authorization

Benefits

• Base Salary
• Stock-based compensation grants

About the company

Menlo Security is the leader in Browser Security for human and agentic workforces. The Menlo Browser Security Platform protects organizations from cyberattacks by stopping threats across the web, documents, and email.