1 day ago
Responsibilities
- Partner with product managers and engineers to threat model initiatives, review designs, and define security requirements.
- Design and build product security features including SSO, SCIM, access controls, audit logging, encryption, and key management.
- Identify systemic engineering risks and lead multi-quarter remediation through secure defaults, shared libraries, and guardrails.
- Define and drive security baselines for cloud and Kubernetes environments, including RBAC, network policies, workload identity, secrets management, and admission control.
- Set Mixpanel’s security approach for AI features, agents, coding tools, MCP integrations, vendors, and internal adoption.
- Harden the software development lifecycle and manage GitHub organization and pipeline security controls.
- Define and implement a centralized secrets management strategy with short-lived credentials, ownership standards, rotation, and leaked-secret remediation.
- Build trusted relationships with engineering and product leaders, influence roadmaps, mentor security engineers, and set technical direction.
Requirements
- 10+ years of experience in security engineering, software engineering, or infrastructure engineering, including significant product or infrastructure security experience.
- Track record of shipping security features or platform changes in partnership with product and engineering teams.
- Deep understanding of securing the software development lifecycle and ability to read code and pipeline configuration.
- Hands-on GitHub organization security experience, including access management, branch protection, GitHub Actions security, secret scanning, and token and app controls.
- Experience designing and rolling out centralized secrets management, workload identity, short-lived credentials, automated rotation, and leaked-secret detection and response.
- Deep product and application security expertise, including threat modeling, secure design review, authentication, authorization, and multi-tenant isolation.
- Experience implementing security features such as SSO, SAML/OIDC, audit logging, or encryption.
- Strong infrastructure security experience in GCP or AWS, including IAM, network security, and Terraform.
- Production Kubernetes security experience covering cluster hardening, RBAC, network policies, admission controllers, and container image security.
- Experience securing AI and LLM-based systems or company-wide AI adoption, including prompt injection, sensitive data exposure, and insecure agent tool use.
- Experience leading cross-team remediation of systemic risk and influencing senior engineers and leaders without direct authority.
- Clear written communication and hands-on use of AI tools such as Claude Code to scale security work.
- Preferred experience includes multi-tenant SaaS or data platforms, software supply chain security, service mesh or zero-trust networking, AI governance, secure-by-default platforms, SOC 2 or ISO 27001 controls, or CKS, OSWE, or OSCP certification.
Benefits
- Comprehensive medical, vision, and dental care.
- Mental wellness benefit, generous vacation, additional company holidays, enhanced parental leave, and volunteer time off.
- Additional US benefits include pre-tax benefits, 401(k), wellness benefit, and holiday break.
- The position is eligible for equity consideration and other benefits; benefits may vary for contract positions.
Tech Stack
Categories
About Mixpanel
Mixpanel builds a self-serve product and web analytics platform for product, growth, and data teams, delivered as SaaS. It offers event-based analytics, funnels, retention, A/B testing, feature flags, session replay, and AI-assisted querying to understand user behavior and improve products. Founded in 2009 and headquartered in San Francisco, it is privately held and used by customers such as Workday, Pinterest, LG, and Rakuten Viber.