Senior Security Engineer - Pentester
Level inferred from job title
Job description
Security Engineer on Menlo Security's security team focused on offensive and defensive testing, penetration testing of product features, and the cloud architecture behind the product. The role runs targeted assessments in a multi-cloud (AWS & GCP) environment before each release and triages bug bounty and external vulnerability reports.
At a glance
- Employment
- Full-time · Employee (employment agreement)
- Work mode
- Remote · Canada
- Pay
- CAD 158,000 – 237,000 / year
What you'll do
- Conduct deep-dive penetration tests of products across a multi-cloud (AWS & GCP) environment, working in tandem with a peer pentester.
- Review IAM policies, service configurations, and cloud-native permission structures across the Control Plane to ensure cloud configurations meet security baselines.
- Execute dynamic testing against web interfaces and API endpoints (Data Plane & Web UI).
- Assess the security posture of hybrid infrastructure spanning containers and virtual machines.
- Triage findings, build clear and reproducible proofs-of-concept, and partner with product teams to explain risk and drive remediation.
- Use AI and large language models to automate reconnaissance, generate attack vectors, analyze configurations, and draft vulnerability reports, applying strong prompt-engineering skills to security contexts.
- Monitor bug bounty pipelines and external reports, validating findings and managing researcher communication.
What we're looking for
- Multi-Cloud Fluency: Deep architectural understanding of GCP and AWS; capable of pivoting seamlessly between providers, performing manual configuration reviews of complex IAM/Resource hierarchies, and leveraging native APIs or modern CSPM frameworks to validate security controls.
- Container Security: Proven experience auditing and hardening managed container services (GKE Autopilot/Standard, EKS, ECS) and self-hosted/unmanaged workloads (K8s, k3s, OCI-runc).
- AI Tooling: Demonstrated ability to integrate AI/LLM tools (e.g., Gemini, Claude) into the pentesting lifecycle to increase speed and coverage.
- Web Application Security: Expert-level knowledge of web application security principles and offensive testing methodologies, with deep proficiency in OWASP Top 10 vulnerabilities, modern web framework exploitation, and API security (REST, WebSockets).
- Extensive hands-on experience conducting manual security assessments using Burp Suite Professional, OWASP ZAP, or similar tooling.
- Strong understanding of browser security mechanisms (CSP, CORS, SameSite cookies, Subresource Integrity), secure authentication/authorization patterns (OAuth 2.0, OIDC, JWT), and security header configurations (HSTS, X-Frame-Options, Permissions-Policy).
- Proven ability to identify complex security flaws beyond automated scanner detection, validate findings through proof-of-concept development, and provide actionable remediation guidance to engineering teams.
- Security Automation: Proficiency in Python, Go, or Bash to eliminate "toil" — writing custom scripts and tooling to automate vulnerability discovery, validate security controls, and streamline testing workflows.
- Infrastructure as Code: Solid grasp of Terraform and cloud-native deployment patterns; able to interpret and audit complex HCL files to identify misconfigurations before they are provisioned.
- Communication: Ability to write high-quality technical reports that Product Teams can easily understand and act upon.
Nice to have
- Experience with Gatekeeper policies and Binary Authorization.
Benefits
All employees may be eligible to become Menlo Security shareholders through eligibility for stock-based compensation grants, which are awarded to employees based on company and individual performance.
- Base salary range for this role is 158,000 CAD - 237,000 CAD.
Apply
About Menlo Security
The leader in Browser Security for human and agentic workforces
Menlo Security protects organizations from cyberattacks by stopping threats across the web, documents, and email before they reach the user. With Menlo Agent Runtime Security (MARS), that protection now extends to the AI agents working alongside every employee.
Mission
To enable humans and agents to connect, communicate, and collaborate securely, without compromise.
Key facts
- Browser Security
- Trusted by major global businesses, including Fortune 500 companies and government agencies
- Backed by top-tier investors
- Menlo Browser Security Platform protects organizations from cyberattacks by stopping threats across the web, documents, and email before they reach the user
- Menlo Agent Runtime Security (MARS) extends protection to AI agents
What they value
- Proactive Leadership
- Straight Talk
- United Impact
- Elevated Talent
- Customer-Compelled