Description
You are a seasoned security professional with a deep passion for uncovering vulnerabilities and improving product security through technical assessments and hands-on penetration testing.
The MongoDB Product Security organization is a diverse collection of individuals working together to scale MongoDB’s security, both security of the products themselves and the security features offered to customers.
Role Responsibilities
As a Product Security Engineer specializing in security assessments, your responsibilities will include:
- Leading the evolution of internal security and assessment processes by leveraging AI-based analysis to enhance threat modeling, penetration testing workflows, and assessment efficiency
- Conducting deep-dive penetration tests and hands-on security assessments of MongoDB products, including architecture reviews, threat modeling, static/dynamic code analysis, and vulnerability exploit verification
- Researching, prototyping, and executing new attack vectors and techniques to strengthen defensive measures
- Collaborating closely with engineering teams to advocate security best practices and remediate identified vulnerabilities
- Recommending secure coding patterns, container security measures, and secrets management strategies to strengthen products
- Partnering with product development teams to ensure secure delivery across cloud environments, applications, and systems
- Coordinating closely with the red team and detection functions and processes to address potential security incidents or implement new defensive or monitoring capabilities
Requirements
- 7+ years of experience in application security, product security, or penetration testing roles, including manual and automated approaches
- Proven expertise in product security assessment techniques such as threat modeling, penetration testing, red teaming, and secure code reviews
- Some programming and scripting skills, with familiarity in one or more languages such as Python or Golang
- Hands-on experience with one or more major cloud providers (AWS, GCP, Azure)
- Experience leading threat modeling workshops and discussing security issues with engineers
- Comfortable explaining and communicating technical concepts and findings to both technical and non-technical audiences
- Demonstrated ownership of security initiatives, with the ability to deliver results autonomously or collaboratively
- Working knowledge of large-scale distributed systems and container technologies (e.g., Kubernetes, Docker)
- Knowledge of security tools and frameworks for cloud and application security
Success in This Role Looks Like
- Driving improvements in MongoDB’s product security through end-to-end ownership of security assessments
- Guiding and mentoring the team through the technological evolution of security assessment processes using modern AI capabilities
- Proactively uncovering vulnerabilities and presenting actionable recommendations to engineering teams
- Building trust and establishing yourself as a key security partner within the organization
- Growing MongoDB’s security capabilities and contributing to innovative solutions that enhance customer trust and product robustness