Product Security Engineer, Security Assessments | MongoDB

You will join MongoDB’s Product Security organization, which secures both the products themselves and the security features offered to customers. The team assesses MongoDB Atlas Cloud, Ops Manager, the Kubernetes Operator, and the MongoDB Server (Community and Enterprise) through threat modeling, code analysis, and penetration testing. As a Product Security Engineer specializing in security assessments, you will run hands-on penetration tests, work with engineering teams to fix vulnerabilities, and use AI tooling to make assessments more efficient.

Key Responsibilities

• Lead the evolution of internal security and assessment processes, using AI-based analysis to improve threat modeling, penetration testing workflows, and efficiency
• Conduct deep-dive penetration tests and security assessments of MongoDB products, including architecture reviews, threat modeling, static and dynamic code analysis, and vulnerability exploit verification
• Research, prototype, and execute new attack vectors and techniques to strengthen defenses
• Collaborate with engineering teams to promote security best practices and remediate vulnerabilities
• Recommend secure coding patterns, container security measures, and secrets management strategies
• Partner with product development teams to ensure secure delivery across cloud environments, applications, and systems
• Coordinate with the red team and detection functions to address potential security incidents and build new defensive or monitoring capabilities

Requirements

• 7+ years of experience in application security, product security, or penetration testing roles, using both manual and automated approaches
• Proven expertise in threat modeling, penetration testing, red teaming, and secure code reviews
• Programming and scripting skills in one or more languages, such as Python or Golang
• Hands-on experience with a major cloud provider (AWS, GCP, or Azure)
• Experience leading threat modeling workshops and discussing security issues with engineers
• Ability to explain technical findings to both technical and non-technical audiences
• Demonstrated ownership of security initiatives, working autonomously or collaboratively
• Working knowledge of large-scale distributed systems and container technologies such as Kubernetes and Docker
• Knowledge of security tools and frameworks for cloud and application security
• Education: Not specified

Skills

Technical Skills

• Penetration testing, red teaming, and threat modeling
• Static and dynamic code analysis, secure code review
• Python or Golang scripting
• AWS, GCP, or Azure
• Kubernetes, Docker, and distributed systems
• Cloud and application security tools and frameworks
• AI-assisted security analysis and automation

Soft Skills

• Clear communication of complex technical concepts
• Collaboration across engineering and security teams
• Ownership and autonomy
• Mentoring and trust-building

Benefits

Benefits for eligible U.S.-based employees may include:

• Equity and an employee stock purchase program
• Flexible paid time off
• 20 weeks of fully paid, gender-neutral parental leave
• Fertility and adoption assistance
• 401(k) plan
• Mental health counseling
• Transgender-inclusive health insurance coverage and other health benefits