Staff Security Engineer

Mixpanel•San Francisco, CA

About The Position

Mixpanel’s Information Security & Risk Management team is hiring a Staff Security Engineer to partner with product and engineering teams to build and operate Mixpanel securely. The role designs and implements product security features, establishes the security approach for adopting and building with AI, and leads lasting, platform-level efforts to reduce systemic risk in the engineering environment. It is a hands-on technical leadership position involving design reviews, system and pipeline hardening, and close partnership with engineering and product leaders so security is incorporated early into planning and delivery. The engineer will set technical direction for product and infrastructure security, influence cross-team work, and mentor security engineers. The role includes securing product design and features; cloud, Kubernetes, GitHub, CI/CD, and the software development lifecycle; secrets management; and AI-powered products, tools, agents, and integrations. Success includes building relationships and assessing engineering risks in the first three months; contributing to major product and AI designs, shipping a security feature, and starting a strategic remediation effort by six months; and removing at least one class of risk through a platform solution, establishing security baselines, and moving production services to standard secrets management by 12 months. This is a staff technical leadership role with a potential growth path to Principal Security Engineer.

Requirements

10+ years of experience in security engineering, software engineering, or infrastructure engineering, including significant time in product security or infrastructure security.
Track record of working closely with product and engineering teams and shipping security features or platform changes with them.
Deep understanding of the full software development lifecycle and how to harden design, code review, CI/CD, build, release, and deployment; comfortable reading code and pipeline configuration.
Hands-on experience hardening GitHub at the organization level, including SSO and access management, branch protection and rulesets, required reviews and CODEOWNERS, GitHub Actions security, secret scanning and push protection, and control of personal access tokens and GitHub Apps.
Experience designing and rolling out secrets management, including centralized secret stores, workload identity and short-lived credentials, automated rotation, and detection and response for leaked secrets.
Deep product and application security expertise, including threat modeling, secure design review, authentication and authorization flaws, and multi-tenant isolation issues.
Experience designing and implementing product security features such as authentication, authorization, SSO (SAML/OIDC), audit logging, or encryption.
Strong infrastructure security experience in GCP or AWS, including IAM, network security, and infrastructure as code such as Terraform.
Production Kubernetes security experience, including cluster hardening, RBAC, network policies, admission controllers, and container image security.
Experience securing AI and LLM-based systems or company-wide AI adoption, including prompt injection, sensitive data exposure, and insecure agent tool use; familiarity with guidance such as the OWASP Top 10 for LLM Applications.
Experience leading cross-team remediation of systemic risk, from problem framing and securing buy-in through delivery.
Strong relationship-building skills and ability to influence senior engineers and leaders without direct authority and make pragmatic risk tradeoffs.
Clear written communication, including design documents and actionable security guidance.
Hands-on experience using AI tools, such as Claude Code, to automate or scale security work.

Nice To Haves

Experience securing a multi-tenant SaaS or data platform.
Experience with software supply chain security, such as SLSA, Sigstore, or SBOMs.
Experience with service mesh or zero-trust networking, such as Istio or mTLS.
Experience building AI governance in practice, such as approved-tool policies, model and AI vendor reviews, or access controls for AI agents and MCP servers.
Experience building secure-by-default libraries or paved-road platforms for engineering teams.
Background as a software engineer before moving into security, or equivalent experience working inside engineering teams.
Experience supporting SOC 2 or ISO 27001 controls in engineering environments.
CKS, OSWE, OSCP, or similar certification.

Responsibilities

Partner with product managers and engineers early in initiatives to threat model, review designs, and define security requirements.
Design and build product security features with product teams, including SSO and SCIM, fine-grained access controls, audit logging, encryption, and key management; guide implementation and validate results.
Identify systemic engineering risks, prioritize them by impact, and lead multi-quarter remediation efforts using secure defaults, shared libraries, and guardrails.
Define and drive security baselines for cloud and Kubernetes environments, including RBAC, network policies, pod security standards, workload identity, secrets management, and admission control.
Set the security approach for adopting and building with AI; threat model AI-powered features and agentic workflows for risks such as prompt injection, data leakage, and excessive agent permissions.
Define guardrails for internal AI coding tools, agents, and MCP integrations, and review AI vendors and integrations with engineering, IT, and legal partners.
Harden the full software development lifecycle, from design and code review through build, release, and deployment.
Own security configuration for the GitHub organization and CI/CD pipelines, including access controls, branch protection, GitHub Actions permissions, secret scanning, dependency and code scanning, and software supply chain controls.
Define and drive secrets management across applications, CI/CD, cloud, and Kubernetes; centralize secrets, replace long-lived credentials with short-lived identity-based access where possible, establish ownership and rotation standards, and lead cleanup of hardcoded or exposed secrets.
Build trusted relationships with engineering and product leaders, work through risk tradeoffs, and get security work onto team roadmaps.
Set technical direction for product and infrastructure security, mentor security engineers, raise security knowledge across engineering, and use AI tools to scale design reviews and automation.