Senior Security Engineer, Menlo Security
Penetration Tester
CA$120-210k
Cloud-based security platform
Be an early applicant
Cloud-based security platform
201-500 employees
Be an early applicant
CA$120-210k
201-500 employees
Company mission
To help businesses and organizations achieve full online productivity to achieve their goals by pre-emptively eliminating cyber attacks.
Role
Who you are
- Multi-Cloud Fluency: Demonstrate a deep architectural understanding of GCP and AWS
- You should be capable of pivoting seamlessly between providers, performing manual configuration reviews of complex IAM/Resource hierarchies, and leveraging native APIs or modern CSPM frameworks to validate security controls
- Container Security: Proven experience auditing and hardening managed container services (GKE Autopilot/Standard, EKS, ECS) and self-hosted/unmanaged workloads (K8s, k3s, OCI-runc)
- Experience with Gatekeeper policies, and Binary Authorization would be considered an asset
- AI Tooling: Demonstrated ability to integrate AI/LLM tools (e.g., Gemini, Claude) into the pentesting lifecycle to increase speed and coverage
- Web Application Security: Expert-level knowledge of web application security principles and offensive testing methodologies, with deep proficiency in OWASP Top 10 vulnerabilities, modern web framework exploitation, and API security (REST, WebSockets)
- Extensive hands-on experience conducting manual security assessments using Burp Suite Professional, OWASP ZAP, or similar tooling
- Strong understanding of browser security mechanisms (CSP, CORS, SameSite cookies, Subresource Integrity), secure authentication/authorization patterns (OAuth 2
- 0, OIDC, JWT), and security header configurations (HSTS, X-Frame-Options, Permissions-Policy)
- Proven ability to identify complex security flaws beyond automated scanner detection, validate findings through proof-of-concept development, and provide actionable remediation guidance to engineering teams
- Security Automation: Proficiency in Python, Go, or Bash to eliminate "toil." You are expected to write custom scripts and tooling to automate vulnerability discovery, validate security controls, and streamline your own testing workflows
- Infrastructure as Code: Solid grasp of Terraform and cloud-native deployment patterns
- You can interpret and audit complex HCL files to identify misconfigurations before they are provisioned
- Communication: Ability to write high-quality technical reports that Product Teams can easily understand and act upon
What the job involves
- We are seeking a forward-thinking Security Engineer to join our team, focusing on offensive and defensive security, the penetration testing of product features, and the cloud architecture supporting the product
- In this role, you will operate across a complex, multi-cloud environment (AWS & GCP) comprising both traditional VMs and modern managed and unmanaged container-based architectures
- In this focused role, you will partner with other security (Penetration Tester and Cloud Security) engineers to execute targeted assessments during specific windows of the product testing phase immediately prior to release
- Success requires you to stay synchronized with the product roadmap and develop a deep technical mastery of new features, enabling you to independently configure environments and test thoroughly within tight timelines
- Your responsibilities extend beyond the application layer to the Control Plane, where you will conduct rigorous infrastructure reviews to ensure that cloud configurations, IAM policies, and orchestration layers meet our security baselines
- Your operational cadence is built on speed: you must identify, validate, and report vulnerabilities quickly to maintain release velocity
- Additionally, you will serve as the frontline for external defenses, monitoring bug bounty pipelines and external reports to triage and respond to findings with professional precision
- Collaborative Penetration Testing (AWS & GCP): Work in tandem with a peer pentester to conduct deep-dive penetration tests of our products across our multi-cloud environment
- Control Plane: Review IAM policies, service configurations, and cloud-native permission structures
- Data Plane & Web UI: Execute dynamic testing against web interfaces and API endpoints
- Infrastructure Review: Assess the security posture of a hybrid infrastructure that mixes containers and Virtual Machines (VMs) infrastructures
- Vulnerability Reporting & Advisory: Triaging findings and creating clear, reproducible proofs-of-concept (PoCs). Collaborating with Product Teams to explain the risk. You may not be responsible for writing the fix or remediating the issue; your role is to ensure the product team understands what to fix
- AI-Augmented Security Assessments: Actively utilize AI and Large Language Models (LLMs) to automate reconnaissance, generate attack vectors, analyze configurations, and draft vulnerability reports. Fluency in prompt engineering for security contexts is essential
- Pipeline Management: Monitor bug bounty pipelines and external reports, validating findings and managing researcher communication
Our take
Menlo Security takes a “zero trust” approach to computer threats by isolating all of a business’s web browsing and putting it on a remote server. Instead of depending upon software to scan and search for threats, it prevents attacks from ever reaching the system. Browsing activity no longer takes place on the end user’s device, instead, it all happens on a remote cloud service which is operated by the company. This service is the largest secure web gateway in the world.
Menlo Security has focused on protecting businesses from web and email attacks, and its model means that it can be integrated with most popular browsers. A particularly appealing aspect of its service is that it doesn’t require businesses to install new software or change their approach, drastically reducing friction for users and making onboarding a far simpler experience.
Currently used by 8 out of 10 of the world's largest banks and capable of completely stopping up to 90% of threats, Menlo Security is in a strong position. It is still continuing to develop its services, however, most recently building out a range of AI-powered tools to detect and prevent phishing and ransomware attacks. Moves like this seem likely to help keep Menlo Security at the forefront of its sector.
Freddie
Company Specialist at Welcome to the Jungle
Insights
-3% employee growth in 12 months
Company
Funding (last 2 of 5 rounds)
Nov 2020
$100m
SERIES E
Jul 2019
$75m
SERIES D
Total funding: $260.5m
Company HQ
Old Mountain View, Mountain View, CA
Leadership
Amir Ben-Efraim
(Co-Founder & CEO)Having studied at UCB, Stanford, and UCLA, they worked in Business Development at Check Point Software before founding Blue Wireless in 1999. They continued to work in Security Software, before co-founding Menlo Security in 2013.
Share this job
View 11 more jobs at Menlo Security