Senior Security Engineer - Pentester

About this role

Menlo Security's https://www.menlosecurity.com/ mission is enabling the world to connect, communicate and collaborate securely without compromise. COVID-19 has made our mission all the more real. We support customers across various enterprises including Fortune 500 companies, 9/10 of the largest global banks and the Department of Defense. The world has fundamentally changed. We are growing from 400 employees into the next phase of our journey, and we need passionate talent filled with empathy and agility. The right candidate for the job is ethical, hyper-organized, fanatical about seeing things through to completion, service-oriented, and humble enough to take feedback and coaching yet confident enough to provide feedback and coaching. Menlo is well-funded for growth and our investors are second to none. They include Vista Equity Partners (“Vista http://www.vistaequitypartners.com/?utm_source=vistapressrelease&utm_campaign=menlosecurity”), General Catalyst, JPMC, American Express, HSBC, and Ericsson Ventures. SUMMARY We're looking for a forward-thinking Security Engineer to join our security team, focused on offensive and defensive testing, penetration testing of product features, and the cloud architecture behind the product. You'll operate across a complex multi-cloud environment (AWS & GCP) spanning traditional VMs and modern managed and unmanaged container-based architectures, partnering with fellow Penetration Testing and Cloud Security engineers to run targeted assessments during the testing window immediately before each release. The role reaches beyond the application layer into the Control Plane, reviewing cloud configurations, IAM policies, and orchestration layers against security baselines, and extends to the frontline of external defense by triaging bug bounty submissions and outside vulnerability reports. AI and large language models are core to how this team works day to day — you'll use them to accelerate reconnaissance, generate attack vectors, analyze configurations, and draft vulnerability reports, while applying human judgment to validate findings and communicate risk clearly to product teams. Speed matters here: the team's operating cadence is built around identifying, validating, and reporting vulnerabilities quickly enough to keep pace with release velocity. OUTCOMES & KPIS Key Outcome(s) Owned: - Ensure new product features and the underlying multi-cloud (AWS/GCP) infrastructure are rigorously security-tested before release, and that vulnerabilities surfaced internally or via bug bounty are triaged and communicated with speed and precision. Success Metrics / KPIs: - Percentage of roadmap features assessed within the pre-release testing window. - Mean time to triage and validate bug bounty / external vulnerability reports. - Reduction in critical/high-severity vulnerabilities escaping to production post-release. - Time saved per assessment cycle through AI-assisted tooling and automation. - Quality and actionability of vulnerability reports and PoCs, as rated by product teams. WHAT YOU'LL DO - Conduct deep-dive penetration tests of products across a multi-cloud (AWS & GCP) environment, working in tandem with a peer pentester. - Review IAM policies, service configurations, and cloud-native permission structures across the Control Plane to ensure cloud configurations meet security baselines. - Execute dynamic testing against web interfaces and API endpoints (Data Plane & Web UI). - Assess the security posture of hybrid infrastructure spanning containers and virtual machines. - Triage findings, build clear and reproducible proofs-of-concept, and partner with product teams to explain risk and drive remediation. - Use AI and large language models to automate reconnaissance, generate attack vectors, analyze configurations, and draft vulnerability reports, applying strong prompt-engineering skills to security contexts. - Monitor bug bounty pipelines and external reports, validating findings and managing researcher communication. FUNCTIONAL COMPETENCIES Required: - Multi-Cloud Fluency: Deep architectural understanding of GCP and AWS. Capable of pivoting seamlessly between providers, performing manual configuration reviews of complex IAM/Resource hierarchies, and leveraging native APIs or modern CSPM frameworks to validate security controls. - Container Security: Proven experience auditing and hardening managed container services (GKE Autopilot/Standard, EKS, ECS) and self-hosted/unmanaged workloads (K8s, k3s, OCI-runc). - AI Tooling: Demonstrated ability to integrate AI/LLM tools (e.g., Gemini, Claude) into the pentesting lifecycle to increase speed and coverage. - Web Application Security: Expert-level knowledge of web application security principles and offensive testing methodologies, with deep proficiency in OWASP Top 10 vulnerabilities, modern web framework exploitation, and API security (REST, WebSockets). Extensive hands-on experience conducting manual security assessments using Burp Suite Professional, OWASP ZAP, or similar tooling. Strong understanding of browser security mechanisms (CSP, CORS, SameSite cookies, Subresource Integrity), secure authentication/authorization patterns (OAuth 2.0, OIDC, JWT), and security header configurations (HSTS, X-Frame-Options, Permissions-Policy). Proven ability to identify complex security flaws beyond automated scanner detection, validate findings through proof-of-concept development, and provide actionable remediation guidance to engineering teams. - Security Automation: Proficiency in Python, Go, or Bash to eliminate "toil" — writing custom scripts and tooling to automate vulnerability discovery, validate security controls, and streamline testing workflows. - Infrastructure as Code: Solid grasp of Terraform and cloud-native deployment patterns; able to interpret and audit complex HCL files to identify misconfigurations before they are provisioned. - Communicat