Security Software Engineer, Infrastructure Security (staff or Senior)

MongoDB MongoDB · Enterprise · New York, NY +2 · Remote · PTO Site Reliability Engineering

Security Software Engineer focused on designing and building scalable security controls and services for MongoDB Atlas multi-cloud infrastructure. This role involves developing secure-by-default infrastructure, APIs, automation, and tooling for security posture management, integrating security into CI/CD and IaC workflows, and collaborating with other engineering teams.

What you'd actually do

  1. Design and build core security primitives and services that protect MongoDB Atlas compute, networking, and identity across AWS, Azure, and GCP
  2. Build secure-by-default infrastructure using Linux security mechanisms (AppArmor, SELinux, seccomp, cgroups), Kubernetes, and eBPF to enforce runtime policies and gain deep visibility into systems behaviour
  3. Develop APIs, automation, and tooling that manage security posture at scale (CSPM, vulnerability management, workload identity) and provide monitoring, logging, and alerting pipelines that integrate with our tooling (Grafana, Splunk, Victoria Metrics.)
  4. Integrate security into our CI/CD and infrastructure-as-code workflows (Terraform) so that security controls are versioned, reviewed, and deployed just like any other code
  5. Lead complex projects end‑to‑end, from problem discovery and design docs to implementation, rollout, and long‑term ownership

Skills

Required

  • Software Engineering
  • Site Reliability Engineering
  • security work
  • Java
  • Golang
  • Rust
  • Python
  • C/C++
  • infrastructure-as-code tools (Terraform)
  • Linux
  • networking concepts
  • Kubernetes
  • cloud provider (AWS, GCP, or Azure)
  • systems mindset
  • communication skills

Nice to have

  • eBPF
  • CSPM
  • vulnerability management
  • RBAC
  • OPA/Gatekeeper
  • Kyverno
  • Falco
  • Tetragon

What the JD emphasized

  • design and build scalable security controls
  • secure-by-default infrastructure
  • runtime policies
  • security posture at scale
  • security controls are versioned, reviewed, and deployed