Senior Level Staff Security Engineer Jobs
Senior level staff security engineer jobs place seasoned professionals at the helm of security architecture, threat modeling programs, and the cross-functional teams that operationalize them across an enterprise. Roles are spread across on-site, remote, and hybrid settings in Technology & Software, Insurance, and Banking & Financial Services, with employers like Databricks, GEICO, and Anthropic hiring at this level now.
Find JobsOverview
Showing 5 of 41+ Senior Level Staff Security Engineer jobs
About Mixpanel
Mixpanel is the leading product intelligence and analytics platform, trusted by more than 29,000 companies to help understand how people use the products they build. By combining powerful analytics with AI that knows your business, Mixpanel helps teams see what’s working, diagnose what’s not, and decide what to build next. Learn more at mixpanel.com.
About The Role
Mixpanel's Information Security & Risk Management (ISRM) team is hiring a Staff Security Engineer to partner with our product and engineering teams on how we build and run Mixpanel securely. You'll help design and implement security features in our product, set the security approach for how we adopt and build with AI, and lead the work to reduce existing risk in our engineering environment through lasting, platform-level solutions rather than one-off fixes. This is a hands-on technical role: you'll review designs, harden systems and pipelines, and build the kind of trust with engineering and product leaders that makes security part of how they plan and ship.
Responsibilities
- Secure product design: Partner with product managers and engineers from the start of new initiatives to threat model, review designs, and define security requirements before code is written.
- Security feature implementation: Design and build security features alongside product teams, such as SSO and SCIM, fine-grained access controls, audit logging, and encryption and key management, guiding engineers through implementation and validating the result.
- Strategic risk remediation: Identify systemic risks in our engineering environment, prioritize them by impact, and lead multi-quarter efforts that remove whole classes of issues through secure defaults, shared libraries, and guardrails.
- Infrastructure and Kubernetes security: Define and drive adoption of security baselines for our cloud and Kubernetes environments, including RBAC, network policies, pod security standards, workload identity, secrets management, and admission control.
- AI security: Set the security approach for how Mixpanel adopts and builds with AI. Threat model AI-powered product features and agentic workflows for risks such as prompt injection, data leakage, and over-permissioned agents, define guardrails for internal use of AI coding tools, agents, and MCP integrations, and review new AI vendors and integrations with engineering, IT, and legal partners.
- Secure development lifecycle: Harden each stage of our SDLC, from design and code review through build, release, and deployment. Own the security configuration of our GitHub organization and CI/CD pipelines, including access controls, branch protection, GitHub Actions permissions, secret scanning, dependency and code scanning, and software supply chain controls, in a way engineers will use rather than work around.
- Secrets management strategy: Define and drive Mixpanel's secrets management strategy across applications, CI/CD, cloud, and Kubernetes. Centralize secrets in a managed store, replace long-lived credentials with short-lived, identity-based access where possible, set standards for ownership and rotation, and lead the cleanup of hardcoded or exposed secrets.
- Partnership and influence: Build trusted relationships with engineering and product leaders, work through risk tradeoffs with them, and get security work onto team roadmaps.
- Technical leadership: Set technical direction for product and infrastructure security, mentor other security engineers, raise security knowledge across engineering, and use AI tools to scale design reviews and automation.
We're Looking For Someone With
- 10+ years of experience in security engineering, software engineering, or infrastructure engineering, with significant time in product security or infrastructure security
- A track record of working closely with product and engineering teams, and of shipping security features or platform changes together with them
- Deep understanding of the full software development lifecycle, from design and code review through CI/CD, build, release, and deployment, and how to harden each stage. You should be comfortable reading code and pipeline configuration, though this role doesn't require writing production code
- Hands-on experience hardening GitHub at the organization level, including SSO and access management, branch protection and rulesets, required reviews and CODEOWNERS, GitHub Actions security (least-privilege workflow tokens, OIDC to cloud providers, pinning third-party actions), secret scanning and push protection, and control of personal access tokens and GitHub Apps
- Experience designing and rolling out a secrets management strategy, including centralized secret stores (e.g. HashiCorp Vault, GCP Secret Manager, AWS Secrets Manager), workload identity and short-lived credentials, automated rotation, and detection and response for leaked secrets
- Deep product and application security expertise, including threat modeling, secure design review, and common vulnerability classes such as authentication and authorization flaws and multi-tenant isolation issues
- Experience designing and implementing product security features such as authentication, authorization, SSO (SAML/OIDC), audit logging, or encryption
- Strong infrastructure security experience in GCP or AWS, including IAM, network security, and infrastructure as code (e.g. Terraform)
- Production Kubernetes security experience, including cluster hardening, RBAC, network policies, admission controllers, and container image security
- Experience securing AI and LLM-based systems or company-wide AI adoption, including risks such as prompt injection, sensitive data exposure, and insecure agent tool use, and familiarity with guidance such as the OWASP Top 10 for LLM Applications
- Experience leading cross-team remediation of systemic risk, from framing the problem and getting buy-in through to delivery
- Strong relationship-building skills, with the ability to influence senior engineers and leaders without direct authority and to make pragmatic risk tradeoffs
- Clear written communication, including design docs and security guidance that engineers can act on
- Hands-on experience using AI tools (e.g. Claude Code) to automate or scale security work
Nice to Have
- Experience securing a multi-tenant SaaS or data platform
- Experience with software supply chain security (e.g. SLSA, Sigstore, SBOMs)
- Experience with service mesh or zero-trust networking (e.g. Istio, mTLS)
- Experience building AI governance in practice, such as approved-tool policies, model and AI vendor reviews, or access controls for AI agents and MCP servers
- Experience building secure-by-default libraries or paved-road platforms for engineering teams
- Background as a software engineer before moving into security, or equivalent experience working inside engineering teams
- Experience supporting SOC 2 or ISO 27001 controls in engineering environments
- CKS, OSWE, OSCP, or similar certification
What Success Looks Like
- First 3 months: You've built working relationships with key engineering and product leads, learned our architecture and threat landscape, and delivered a prioritized assessment of the largest risks in our engineering environment with a proposed remediation strategy.
- By 6 months: You're part of the design process for major product initiatives, including AI features, have shipped or co-built at least one security feature, the first strategic remediation effort is underway with engineering owners committed, and teams have clear security guardrails for adopting AI tools and agents.
- By 12 months: You've removed at least one class of risk across our environment through a platform-level solution, established GitHub, CI/CD, Kubernetes, and cloud security baselines that teams follow by default, moved production services onto our standard secrets management approach, and are the partner engineering and product teams seek out early on security decisions.
Growth Path
This is a staff technical leadership role in our security engineering career path. From here, you can grow into Principal Security Engineer, where you'll set Mixpanel's long-term security architecture and shape how security and engineering work together across the company.
Compensation
The amount listed below is the total target cash compensation (TTCC) and includes base compensation and variable compensation in the form of either a company bonus or commissions. Variable compensation type is determined by your role and level. In addition to the cash compensation provided, this position is also eligible for equity consideration and other benefits including medical, vision, and dental insurance coverage. You can view our benefits offerings here. Our salary ranges are determined by role and level and are benchmarked to the SF Bay Area Technology data cut released by Radford, a global compensation database. The range displayed represents the minimum and maximum TTCC for new hire salaries for the position across all of our US locations. To stay on top of market conditions, we refresh our salary ranges twice a year so these ranges may change in the future. Within the range, individual pay is determined by experience, job-related skills, qualifications, and other factors. If you have questions about the specific range, your recruiter can share this information. Mixpanel Compensation Range $230,000 - $300,000 USD
Benefits And Perks
- Comprehensive Medical, Vision, and Dental Care
- Mental Wellness Benefit
- Generous Vacation Policy & Additional Company Holidays
- Enhanced Parental Leave
- Volunteer Time Off
- Additional US Benefits: Pre-Tax Benefits including 401(K), Wellness Benefit, Holiday Break
- please note that benefits and perks for contract positions will vary
Culture Values
- Make Bold Bets: We choose courageous action over comfortable progress.
- Innovate with Insight: We tackle decisions with rigor and judgment - combining data, experience and collective wisdom to drive powerful outcomes.
- One Team: We collaborate across boundaries to achieve far greater impact than any of us could accomplish alone.
- Candor with Connection: We build meaningful relationships that enable honest feedback and direct conversations.
- Champion the Customer: We seek to deeply understand our customers’ needs, ensuring their success is our north star.
- Powerful Simplicity: We find elegant solutions to complex problems, making sophisticated things accessible.
Why choose Mixpanel?
We’re a leader in analytics with over 29,000 customers and $277M invested from prominent investors: like Andreessen-Horowitz, Sequoia, YC, and, most recently, Bain Capital. Mixpanel’s pioneering event-based data analytics platform offers a powerful yet simple solution for companies to understand user behaviors and easily track overarching company success metrics. Our accomplished teams continuously facilitate our expansion by tackling the ever-evolving challenges tied to scaling, reliability, design, and service. Choosing to work at Mixpanel means you’ll be helping the world’s most innovative companies learn from their data so they can make better decisions.
Mixpanel is an equal opportunity employer supporting workforce diversity. At Mixpanel, we are focused on things that really matter—our people, our customers, our partners—out of a recognition that those relationships are the most valuable assets we have. We actively encourage women, people with disabilities, veterans, underrepresented minorities, and LGBTQ+ people to apply. We do not discriminate on the basis of race, religion, color, national origin, gender, gender identity or expression, sexual orientation, age, marital status, veteran status, or disability status. Pursuant to the San Francisco Fair Chance Ordinance or other similar laws that may be applicable, we will consider for employment qualified applicants with arrest and conviction records.
We’ve immersed ourselves in our Culture and Values as our guiding principles for the impact we want to have and the future we are building.
About Mixpanel
Mixpanel is the leading product intelligence and analytics platform, trusted by more than 29,000 companies to help understand how people use the products they build. By combining powerful analytics with AI that knows your business, Mixpanel helps teams see what’s working, diagnose what’s not, and decide what to build next. Learn more at mixpanel.com.
About The Role
Mixpanel's Information Security & Risk Management (ISRM) team is hiring a Staff Security Engineer to partner with our product and engineering teams on how we build and run Mixpanel securely. You'll help design and implement security features in our product, set the security approach for how we adopt and build with AI, and lead the work to reduce existing risk in our engineering environment through lasting, platform-level solutions rather than one-off fixes. This is a hands-on technical role: you'll review designs, harden systems and pipelines, and build the kind of trust with engineering and product leaders that makes security part of how they plan and ship.
Responsibilities
- Secure product design: Partner with product managers and engineers from the start of new initiatives to threat model, review designs, and define security requirements before code is written.
- Security feature implementation: Design and build security features alongside product teams, such as SSO and SCIM, fine-grained access controls, audit logging, and encryption and key management, guiding engineers through implementation and validating the result.
- Strategic risk remediation: Identify systemic risks in our engineering environment, prioritize them by impact, and lead multi-quarter efforts that remove whole classes of issues through secure defaults, shared libraries, and guardrails.
- Infrastructure and Kubernetes security: Define and drive adoption of security baselines for our cloud and Kubernetes environments, including RBAC, network policies, pod security standards, workload identity, secrets management, and admission control.
- AI security: Set the security approach for how Mixpanel adopts and builds with AI. Threat model AI-powered product features and agentic workflows for risks such as prompt injection, data leakage, and over-permissioned agents, define guardrails for internal use of AI coding tools, agents, and MCP integrations, and review new AI vendors and integrations with engineering, IT, and legal partners.
- Secure development lifecycle: Harden each stage of our SDLC, from design and code review through build, release, and deployment. Own the security configuration of our GitHub organization and CI/CD pipelines, including access controls, branch protection, GitHub Actions permissions, secret scanning, dependency and code scanning, and software supply chain controls, in a way engineers will use rather than work around.
- Secrets management strategy: Define and drive Mixpanel's secrets management strategy across applications, CI/CD, cloud, and Kubernetes. Centralize secrets in a managed store, replace long-lived credentials with short-lived, identity-based access where possible, set standards for ownership and rotation, and lead the cleanup of hardcoded or exposed secrets.
- Partnership and influence: Build trusted relationships with engineering and product leaders, work through risk tradeoffs with them, and get security work onto team roadmaps.
- Technical leadership: Set technical direction for product and infrastructure security, mentor other security engineers, raise security knowledge across engineering, and use AI tools to scale design reviews and automation.
We're Looking For Someone With
- 10+ years of experience in security engineering, software engineering, or infrastructure engineering, with significant time in product security or infrastructure security
- A track record of working closely with product and engineering teams, and of shipping security features or platform changes together with them
- Deep understanding of the full software development lifecycle, from design and code review through CI/CD, build, release, and deployment, and how to harden each stage. You should be comfortable reading code and pipeline configuration, though this role doesn't require writing production code
- Hands-on experience hardening GitHub at the organization level, including SSO and access management, branch protection and rulesets, required reviews and CODEOWNERS, GitHub Actions security (least-privilege workflow tokens, OIDC to cloud providers, pinning third-party actions), secret scanning and push protection, and control of personal access tokens and GitHub Apps
- Experience designing and rolling out a secrets management strategy, including centralized secret stores (e.g. HashiCorp Vault, GCP Secret Manager, AWS Secrets Manager), workload identity and short-lived credentials, automated rotation, and detection and response for leaked secrets
- Deep product and application security expertise, including threat modeling, secure design review, and common vulnerability classes such as authentication and authorization flaws and multi-tenant isolation issues
- Experience designing and implementing product security features such as authentication, authorization, SSO (SAML/OIDC), audit logging, or encryption
- Strong infrastructure security experience in GCP or AWS, including IAM, network security, and infrastructure as code (e.g. Terraform)
- Production Kubernetes security experience, including cluster hardening, RBAC, network policies, admission controllers, and container image security
- Experience securing AI and LLM-based systems or company-wide AI adoption, including risks such as prompt injection, sensitive data exposure, and insecure agent tool use, and familiarity with guidance such as the OWASP Top 10 for LLM Applications
- Experience leading cross-team remediation of systemic risk, from framing the problem and getting buy-in through to delivery
- Strong relationship-building skills, with the ability to influence senior engineers and leaders without direct authority and to make pragmatic risk tradeoffs
- Clear written communication, including design docs and security guidance that engineers can act on
- Hands-on experience using AI tools (e.g. Claude Code) to automate or scale security work
Nice to Have
- Experience securing a multi-tenant SaaS or data platform
- Experience with software supply chain security (e.g. SLSA, Sigstore, SBOMs)
- Experience with service mesh or zero-trust networking (e.g. Istio, mTLS)
- Experience building AI governance in practice, such as approved-tool policies, model and AI vendor reviews, or access controls for AI agents and MCP servers
- Experience building secure-by-default libraries or paved-road platforms for engineering teams
- Background as a software engineer before moving into security, or equivalent experience working inside engineering teams
- Experience supporting SOC 2 or ISO 27001 controls in engineering environments
- CKS, OSWE, OSCP, or similar certification
What Success Looks Like
- First 3 months: You've built working relationships with key engineering and product leads, learned our architecture and threat landscape, and delivered a prioritized assessment of the largest risks in our engineering environment with a proposed remediation strategy.
- By 6 months: You're part of the design process for major product initiatives, including AI features, have shipped or co-built at least one security feature, the first strategic remediation effort is underway with engineering owners committed, and teams have clear security guardrails for adopting AI tools and agents.
- By 12 months: You've removed at least one class of risk across our environment through a platform-level solution, established GitHub, CI/CD, Kubernetes, and cloud security baselines that teams follow by default, moved production services onto our standard secrets management approach, and are the partner engineering and product teams seek out early on security decisions.
Growth Path
This is a staff technical leadership role in our security engineering career path. From here, you can grow into Principal Security Engineer, where you'll set Mixpanel's long-term security architecture and shape how security and engineering work together across the company.
Compensation
The amount listed below is the total target cash compensation (TTCC) and includes base compensation and variable compensation in the form of either a company bonus or commissions. Variable compensation type is determined by your role and level. In addition to the cash compensation provided, this position is also eligible for equity consideration and other benefits including medical, vision, and dental insurance coverage. You can view our benefits offerings here. Our salary ranges are determined by role and level and are benchmarked to the SF Bay Area Technology data cut released by Radford, a global compensation database. The range displayed represents the minimum and maximum TTCC for new hire salaries for the position across all of our US locations. To stay on top of market conditions, we refresh our salary ranges twice a year so these ranges may change in the future. Within the range, individual pay is determined by experience, job-related skills, qualifications, and other factors. If you have questions about the specific range, your recruiter can share this information. Mixpanel Compensation Range $230,000 - $300,000 USD
Benefits And Perks
- Comprehensive Medical, Vision, and Dental Care
- Mental Wellness Benefit
- Generous Vacation Policy & Additional Company Holidays
- Enhanced Parental Leave
- Volunteer Time Off
- Additional US Benefits: Pre-Tax Benefits including 401(K), Wellness Benefit, Holiday Break
- please note that benefits and perks for contract positions will vary
Culture Values
- Make Bold Bets: We choose courageous action over comfortable progress.
- Innovate with Insight: We tackle decisions with rigor and judgment - combining data, experience and collective wisdom to drive powerful outcomes.
- One Team: We collaborate across boundaries to achieve far greater impact than any of us could accomplish alone.
- Candor with Connection: We build meaningful relationships that enable honest feedback and direct conversations.
- Champion the Customer: We seek to deeply understand our customers’ needs, ensuring their success is our north star.
- Powerful Simplicity: We find elegant solutions to complex problems, making sophisticated things accessible.
Why choose Mixpanel?
We’re a leader in analytics with over 29,000 customers and $277M invested from prominent investors: like Andreessen-Horowitz, Sequoia, YC, and, most recently, Bain Capital. Mixpanel’s pioneering event-based data analytics platform offers a powerful yet simple solution for companies to understand user behaviors and easily track overarching company success metrics. Our accomplished teams continuously facilitate our expansion by tackling the ever-evolving challenges tied to scaling, reliability, design, and service. Choosing to work at Mixpanel means you’ll be helping the world’s most innovative companies learn from their data so they can make better decisions.
Mixpanel is an equal opportunity employer supporting workforce diversity. At Mixpanel, we are focused on things that really matter—our people, our customers, our partners—out of a recognition that those relationships are the most valuable assets we have. We actively encourage women, people with disabilities, veterans, underrepresented minorities, and LGBTQ+ people to apply. We do not discriminate on the basis of race, religion, color, national origin, gender, gender identity or expression, sexual orientation, age, marital status, veteran status, or disability status. Pursuant to the San Francisco Fair Chance Ordinance or other similar laws that may be applicable, we will consider for employment qualified applicants with arrest and conviction records.
We’ve immersed ourselves in our Culture and Values as our guiding principles for the impact we want to have and the future we are building.
See All 41 Senior Level Staff Security Engineer Jobs
Find roles that match your experience and apply in just a few clicks.
Find JobsSenior Level Staff Security Engineer Job Market
Who's Hiring
Top Industries Hiring
- Technology & Software18
- Insurance5
- Banking & Financial Services5
- Science & Research4
- Investment & Asset Management3
Senior Level Staff Security Engineer Jobs: Frequently Asked Questions
How do I get a senior level staff security engineer job?
Candidates who land senior level staff security engineer roles typically demonstrate ownership of security programs, not just participation in them. Employers at this level look for engineers who have led threat modeling initiatives, architected zero-trust or cloud-native security frameworks, and mentored junior engineers. A history of cross-functional influence, strong incident response leadership, and published research or CVEs can sharpen your edge significantly.
Which companies hire senior level staff security engineers?
Companies hiring senior level staff security engineers right now include Databricks, GEICO, and Anthropic, based on current listings on Migrate Mate as of November 2026. Hiring at this level tends to concentrate in large technology firms, financial institutions, defense contractors, and fast-scaling companies that need experienced engineers to own security strategy rather than execute tasks.
Are there remote senior level staff security engineer jobs?
Yes, though availability depends on the employer and security clearance requirements. About 53% of senior level staff security engineer openings are remote or hybrid as of November 2026, reflecting broad industry acceptance of distributed security teams. Roles involving classified environments or hands-on infrastructure work are more likely to require on-site presence.
What makes a staff security engineer role senior level?
Senior level staff security engineer roles are defined by scope and ownership. Where mid-level engineers execute within defined systems, senior engineers set the direction, own the outcomes, and are accountable for org-wide security posture. They lead complex vulnerability programs, evaluate emerging threat landscapes, design multi-system architectures, and actively develop the engineers around them through mentorship and code review.
Which industries hire the most senior level staff security engineers?
Senior Level staff security engineer roles concentrate in Technology & Software, Insurance, and Banking & Financial Services, based on current listings on Migrate Mate as of November 2026. These sectors drive hiring at this level because they handle sensitive data at scale, operate under strict regulatory requirements, or manage critical infrastructure that demands deeply experienced security leadership rather than generalist coverage.