Staff Security Engineer

Mixpanel•San Francisco, CA

1d•$230,000 - $300,000

About The Position

Mixpanel’s Information Security & Risk Management team is hiring a Staff Security Engineer to partner with product and engineering teams to help build and operate Mixpanel securely. This hands-on technical leadership role focuses on designing and implementing product security features, setting the security approach for AI adoption and development, and reducing systemic risk through lasting, platform-level solutions rather than one-off fixes. The engineer will review designs, harden systems and pipelines, and build trusted relationships with engineering and product leaders so security is incorporated into planning and delivery. The role provides technical direction for product and infrastructure security, including secure product design, cloud and Kubernetes security, the software development lifecycle, GitHub and CI/CD configuration, and secrets management. It also includes threat modeling AI-powered features and agentic workflows, establishing guardrails for internal AI tools and integrations, assessing AI vendors, mentoring security engineers, and using AI tools to scale security reviews and automation. Success includes building relationships and assessing major engineering risks during the first three months; participating in major product and AI feature design, shipping or co-building a security feature, and beginning a strategic remediation effort by six months; and removing at least one class of risk through a platform-level solution, establishing security baselines, and moving production services to the standard secrets-management approach by 12 months. This is a staff technical leadership role with a potential growth path to Principal Security Engineer.

Requirements

10+ years of experience in security engineering, software engineering, or infrastructure engineering, with significant time in product security or infrastructure security.
Track record of working closely with product and engineering teams and shipping security features or platform changes with them.
Deep understanding of the software development lifecycle, from design and code review through CI/CD, build, release, and deployment, and how to harden each stage; comfortable reading code and pipeline configuration. Production-code writing is not required.
Hands-on experience hardening GitHub at the organization level, including SSO and access management, branch protection and rulesets, required reviews and CODEOWNERS, GitHub Actions security, secret scanning and push protection, and control of personal access tokens and GitHub Apps.
Experience designing and rolling out secrets-management strategies, including centralized secret stores, workload identity and short-lived credentials, automated rotation, and detection and response for leaked secrets.
Deep product and application security expertise, including threat modeling, secure design review, and vulnerability classes such as authentication and authorization flaws and multi-tenant isolation issues.
Experience designing and implementing product security features such as authentication, authorization, SSO (SAML/OIDC), audit logging, or encryption.
Strong infrastructure security experience in GCP or AWS, including IAM, network security, and infrastructure as code such as Terraform.
Production Kubernetes security experience, including cluster hardening, RBAC, network policies, admission controllers, and container image security.
Experience securing AI and LLM-based systems or company-wide AI adoption, including prompt injection, sensitive data exposure, and insecure agent tool use; familiarity with guidance such as the OWASP Top 10 for LLM Applications.
Experience leading cross-team remediation of systemic risk, from framing the problem and gaining buy-in through delivery.
Strong relationship-building skills and ability to influence senior engineers and leaders without direct authority and make pragmatic risk tradeoffs.
Clear written communication, including design documents and actionable security guidance for engineers.
Hands-on experience using AI tools, such as Claude Code, to automate or scale security work.

Nice To Haves

Experience securing a multi-tenant SaaS or data platform.
Experience with software supply-chain security, such as SLSA, Sigstore, or SBOMs.
Experience with service mesh or zero-trust networking, such as Istio or mTLS.
Experience building AI governance in practice, such as approved-tool policies, model and AI vendor reviews, or access controls for AI agents and MCP servers.
Experience building secure-by-default libraries or paved-road platforms for engineering teams.
Background as a software engineer before moving into security, or equivalent experience working inside engineering teams.
Experience supporting SOC 2 or ISO 27001 controls in engineering environments.
CKS, OSWE, OSCP, or similar certification.

Responsibilities

Partner with product managers and engineers from the start of initiatives to threat model, review designs, and define security requirements.
Design and build product security features with product teams, including SSO and SCIM, fine-grained access controls, audit logging, encryption, and key management; guide implementation and validate results.
Identify systemic engineering-environment risks, prioritize them by impact, and lead multi-quarter remediation through secure defaults, shared libraries, and guardrails.
Define and drive adoption of cloud and Kubernetes security baselines, including RBAC, network policies, pod security standards, workload identity, secrets management, and admission control.
Set the security approach for Mixpanel’s AI adoption and development; threat model AI features and agentic workflows, establish guardrails for AI coding tools, agents, and MCP integrations, and review AI vendors and integrations with engineering, IT, and legal partners.
Harden the secure development lifecycle from design and code review through build, release, and deployment.
Own security configuration for the GitHub organization and CI/CD pipelines, including access controls, branch protection, GitHub Actions permissions, secret scanning, dependency and code scanning, and software supply-chain controls.
Define and drive a secrets-management strategy across applications, CI/CD, cloud, and Kubernetes; centralize secrets, replace long-lived credentials with short-lived identity-based access where possible, set ownership and rotation standards, and lead cleanup of hardcoded or exposed secrets.
Build trusted relationships with engineering and product leaders, work through risk tradeoffs, and get security work onto team roadmaps.
Set technical direction for product and infrastructure security, mentor security engineers, raise security knowledge across engineering, and use AI tools to scale design reviews and automation.

Benefits

Medical insurance
Vision insurance
Dental insurance
Mental wellness benefit
Generous vacation policy
Additional company holidays
Enhanced parental leave
Volunteer time off
Pre-tax benefits
401(k)
Wellness benefit
Holiday break
Equity consideration
Company bonus or commissions as variable compensation, depending on role and level