About Mixpanel

Mixpanel is the leading product intelligence and analytics platform, trusted by more than 29,000 companies to help understand how people use the products they build. By combining powerful analytics with AI that knows your business, Mixpanel helps teams see what’s working, diagnose what’s not, and decide what to build next. Learn more at mixpanel.com.

About the Role

Mixpanel's Information Security & Risk Management (ISRM) team is hiring a Staff Security Engineer to partner with our product and engineering teams on how we build and run Mixpanel securely. You'll help design and implement security features in our product, set the security approach for how we adopt and build with AI, and lead the work to reduce existing risk in our engineering environment through lasting, platform-level solutions rather than one-off fixes. This is a hands-on technical role: you'll review designs, harden systems and pipelines, and build the kind of trust with engineering and product leaders that makes security part of how they plan and ship.

Responsibilities

Secure product design: Partner with product managers and engineers from the start of new initiatives to threat model, review designs, and define security requirements before code is written.
Security feature implementation: Design and build security features alongside product teams, such as SSO and SCIM, fine-grained access controls, audit logging, and encryption and key management, guiding engineers through implementation and validating the result.
Strategic risk remediation: Identify systemic risks in our engineering environment, prioritize them by impact, and lead multi-quarter efforts that remove whole classes of issues through secure defaults, shared libraries, and guardrails.
Infrastructure and Kubernetes security: Define and drive adoption of security baselines for our cloud and Kubernetes environments, including RBAC, network policies, pod security standards, workload identity, secrets management, and admission control.
AI security: Set the security approach for how Mixpanel adopts and builds with AI. Threat model AI-powered product features and agentic workflows for risks such as prompt injection, data leakage, and over-permissioned agents, define guardrails for internal use of AI coding tools, agents, and MCP integrations, and review new AI vendors and integrations with engineering, IT, and legal partners.
Secure development lifecycle: Harden each stage of our SDLC, from design and code review through build, release, and deployment. Own the security configuration of our GitHub organization and CI/CD pipelines, including access controls, branch protection, GitHub Actions permissions, secret scanning, dependency and code scanning, and software supply chain controls, in a way engineers will use rather than work around.
Secrets management strategy: Define and drive Mixpanel's secrets management strategy across applications, CI/CD, cloud, and Kubernetes. Centralize secrets in a managed store, replace long-lived credentials with short-lived, identity-based access where possible, set standards for ownership and rotation, and lead the cleanup of hardcoded or exposed secrets.
Partnership and influence: Build trusted relationships with engineering and product leaders, work through risk tradeoffs with them, and get security work onto team roadmaps.
Technical leadership: Set technical direction for product and infrastructure security, mentor other security engineers, raise security knowledge across engineering, and use AI tools to scale design reviews and automation.

We're Looking For Someone With

10+ years of experience in security engineering, software engineering, or infrastructure engineering, with significant time in product security or infrastructure security
A track record of working closely with product and engineering teams, and of shipping security features or platform changes together with them
Deep understanding of the full software development lifecycle, from design and code review through CI/CD, build, release, and deployment, and how to harden each stage. You should be comfortable reading code and pipeline configuration, though this role doesn't require writing production code