Product Security Engineer, Security Assessments | MongoDB

The Briefed; New York (NY); On-site; USD 170,000 - 230,000; Full time

Benefits offered by this job

Equity

Flexible paid time off

Parental leave

Fertility and adoption assistance

401(k) plan

Mental health counseling

Health insurance

Job summary

MongoDB's Product Security organization is seeking a Product Security Engineer specializing in security assessments. You will run hands-on penetration tests, perform threat modeling and code analysis across MongoDB products, and work with engineering teams to fix vulnerabilities using AI-assisted tooling.

In this senior role, you will communicate complex findings to diverse audiences, drive secure delivery across cloud environments, and contribute to evolving security practices within a

Qualifications

• 7+ years of experience in application or product security.
• Proven expertise in threat modeling, penetration testing, red teaming, and secure code reviews.
• Programming in Python or Golang.
• Hands-on cloud experience with AWS, GCP, or Azure.
• Ability to explain findings to technical and non-technical audiences.
• Experience with Kubernetes and Docker.

Responsibilities

• Lead evolution of security assessment processes using AI-based analysis.
• Conduct deep-dive penetration tests and security assessments of MongoDB products.
• Research, prototype, and execute new attack vectors to strengthen defenses.
• Collaborate with engineering to remediate vulnerabilities and promote security best practices.
• Recommend secure coding patterns and container security measures.
• Partner with product teams to ensure secure delivery across cloud environments.
• Coordinate with the red team and detection to address incidents and build defenses.

Skills

Threat modeling

Penetration testing

Secure code reviews

Python

Golang

AWS/GCP/Azure

Kubernetes

Docker

Red teaming

Communication

Job description

You will join MongoDB’s Product Security organization, which secures both the products themselves and the security features offered to customers. The team assesses MongoDB Atlas Cloud, Ops Manager, the Kubernetes Operator, and the MongoDB Server (Community and Enterprise) through threat modeling, code analysis, and penetration testing. As a Product Security Engineer specializing in security assessments, you will run hands-on penetration tests, work with engineering teams to fix vulnerabilities, and use AI tooling to make assessments more efficient.

Key Responsibilities

• Lead the evolution of internal security and assessment processes, using AI-based analysis to improve threat modeling, penetration testing workflows, and efficiency
• Conduct deep-dive penetration tests and security assessments of MongoDB products, including architecture reviews, threat modeling, static and dynamic code analysis, and vulnerability exploit verification
• Research, prototype, and execute new attack vectors and techniques to strengthen defenses
• Collaborate with engineering teams to promote security best practices and remediate vulnerabilities
• Recommend secure coding patterns, container security measures, and secrets management strategies
• Partner with product development teams to ensure secure delivery across cloud environments, applications, and systems
• Coordinate with the red team and detection functions to address potential security incidents and build new defensive or monitoring capabilities

Requirements

• 7+ years of experience in application security, product security, or penetration testing roles, using both manual and automated approaches
• Proven expertise in threat modeling, penetration testing, red teaming, and secure code reviews
• Programming and scripting skills in one or more languages, such as Python or Golang
• Hands-on experience with a major cloud provider (AWS, GCP, or Azure)
• Experience leading threat modeling workshops and discussing security issues with engineers
• Ability to explain technical findings to both technical and non-technical audiences
• Demonstrated ownership of security initiatives, working autonomously or collaboratively
• Working knowledge of large-scale distributed systems and container technologies such as Kubernetes and Docker
• Knowledge of security tools and frameworks for cloud and application security
• Education: Not specified

Skills

Technical Skills

• Penetration testing, red teaming, and threat modeling
• Static and dynamic code analysis, secure code review
• Python or Golang scripting
• AWS, GCP, or Azure
• Kubernetes, Docker, and distributed systems
• Cloud and application security tools and frameworks
• AI-assisted security analysis and automation

Soft Skills

• Clear communication of complex technical concepts
• Collaboration across engineering and security teams
• Ownership and autonomy
• Mentoring and trust-building

Benefits

Benefits for eligible U.S.-based employees may include:

• Equity and an employee stock purchase program
• Flexible paid time off
• 20 weeks of fully paid, gender-neutral parental leave
• Fertility and adoption assistance
• 401(k) plan
• Mental health counseling
• Transgender-inclusive health insurance coverage and other health benefits