CyberSecurity, Product Security Engineer
About Mistral
Mistral provides full-stack AI solutions: from frontier models to developer tools, applications, and compute. We partner with enterprises tackling the hardest problems-across high-stakes industries like finance, manufacturing, defense, healthcare, and the public sector-co-creating customized AI systems that they can run on their terms.
We are a dynamic, collaborative team passionate about AI and its potential to transform society. Our diverse workforce thrives in competitive environments and is committed to driving innovation. Our teams are distributed between Europe, North America, Asia and the Middle East. We are creative, low-ego and team-spirited.
Role summary
As a Product Security Engineer within the Cybersecurity organization, you will be the dedicated security partner for one or more product organizations (such as Vibe, Studio or Forge).
You will work alongside engineers, researchers and product managers to ensure security is built into every stage of the product lifecycle-from early design and architecture decisions through implementation, production deployment and continuous evolution.
Your mission is to help engineering teams build secure products without slowing them down. Rather than acting as a gatekeeper, you will enable teams to make sound security decisions through secure-by-design principles, pragmatic engineering guidance and scalable security automation.
You will own the Product Security strategy for your product portfolio, influence engineering decisions, and help define how secure software is built across one of the world's leading AI companies.
What you will do
Serve as the dedicated Product Security partner for one or more product organizations.
Drive security throughout the entire product lifecycle, from design and architecture reviews to production deployment and ongoing operation.
Lead threat modeling, security architecture reviews and risk assessments for new features, APIs and major architectural changes.
Define pragmatic security requirements and secure-by-default patterns that enable engineering teams to ship safely at high velocity for a specific product.
Review critical designs and code, focusing on authentication, authorization, tenant isolation, data protection, cryptography and other high-impact security controls.
Design product-specific security validation strategies, including targeted testing, abuse-case development and guided agent-based security assessments tailored to each product's architecture and workflows.
Partner with engineering teams to prioritize and remediate vulnerabilities identified through code reviews, penetration testing, bug bounty programs and automated security testing.
Collaborate with Security Engineering to improve reusable security platforms, developer guardrails and security capabilities integrated into the SDLC.
Champion secure software engineering through coaching, technical leadership, reusable design patterns and Security Champion programs.
Define Product Security metrics, continuously improve the security posture of your products and help shape Product Security practices across the company.
What we're looking for:
5+ years of experience in Product Security, Application Security or Software Engineering with a strong security focus.
Strong understanding of modern software architecture, distributed systems, APIs and cloud-native applications.
Demonstrated experience performing threat modeling, architecture reviews and secure design assessments.
Deep understanding of modern software security, including authentication, authorization, cryptography, secrets management, tenant isolation, secure data flows and common vulnerability classes (OWASP Top 10, CWE).
Strong software engineering skills in Python, Go, TypeScript or similar languages, with the ability to review production code and build security automation.
Experience with application security testing techniques, including manual code review, penetration testing, bug bounty programs.
Experience designing product-specific security testing approaches, including security automation or agent-based testing, is highly valued.
Strong understanding of Secure SDLC principles from product design through production deployment and long-term maintenance.
Excellent communication and influencing skills, with the ability to earn trust across engineering organizations and balance security, product delivery and developer experience.
A pragmatic, engineering-first mindset with strong technical judgment and a focus on solving meaningful security problems.
What We Offer
We offer a comprehensive benefits package designed to support your well-being, growth, and work-life balance. Benefits vary by country and may include healthcare coverage, parental leave, retirement plans, relocation support, wellness programs, meal and transportation allowances, and other location-specific perks.
For the most up-to-date details on benefits available in your location, please refer to our Benefits page.
Privacy Policy
Your privacy matters to us. You can learn more about how we handle your personal data in our Applicant Privacy Policy.