Product Security Engineer: AI Secure-by-Design

Mistral; Paris; Hybrid; EUR 90,000 - 130,000; Full time

Job summary

Mistral is seeking a Product Security Engineer to partner with product teams and embed security across the lifecycle from design to deployment. You will drive threat modeling, secure design patterns, and pragmatic security criteria to enable fast, safe delivery of features.

You will review designs and code for authentication, authorization, data protection and cryptography, while mentoring teams in secure practices and building reusable security platforms within the SDLC.

Qualifications

• 5+ years of experience in Product Security, Application Security or Software Engineering with a strong security focus.
• Strong understanding of modern software architecture, distributed systems, APIs and cloud-native applications.
• Demonstrated experience performing threat modeling, architecture reviews and secure design assessments.
• Deep understanding of modern software security, including authentication, authorization, cryptography, secrets management, tenant isolation, secure data flows and common vulnerability classes (OWASP Top 10, CWE).
• Strong software engineering skills in Python, Go, TypeScript or similar languages, with the ability to review production code and build security automation.
• Experience with application security testing techniques, including manual code review, penetration testing, bug bounty programs.
• Experience designing product-specific security testing approaches, including security automation or agent-based testing, is highly valued.
• Strong understanding of Secure SDLC principles from product design through production deployment and long-term maintenance.
• Excellent communication and influencing skills, with the ability to earn trust across engineering organizations and balance security, product delivery and developer experience.
• A pragmatic, engineering-first mindset with strong technical judgment and a focus on solving meaningful security problems.

Responsibilities

• Serve as the dedicated Product Security partner for one or more product organizations.
• Drive security throughout the entire product lifecycle, from design and architecture reviews to production deployment and ongoing operation.
• Lead threat modeling, security architecture reviews and risk assessments for new features, APIs and major architectural changes.
• Define pragmatic security requirements and secure-by-default patterns that enable engineering teams to ship safely at high velocity for a specific product.
• Review critical designs and code, focusing on authentication, authorization, tenant isolation, data protection, cryptography and other high-impact security controls.
• Design product-specific security validation strategies, including targeted testing, abuse-case development and guided agent-based security assessments tailored to each product's architecture and workflows.
• Partner with engineering teams to prioritize and remediate vulnerabilities identified through code reviews, penetration testing, bug bounty programs and automated security testing.
• Collaborate with Security Engineering to improve reusable security platforms, developer guardrails and security capabilities integrated into the SDLC.
• Champion secure software engineering through coaching, technical leadership, reusable design patterns and Security Champion programs.
• Define Product Security metrics, continuously improve the security posture of your products and help shape Product Security practices across the company.

Skills

Product Security

Threat modeling

Architecture reviews

Secure design

Auth & Authorization

Cryptography

Secrets management

Tenant isolation

Secure data flows

OWASP Top 10

Python

Go

TypeScript

Code review

Penetration testing

Bug bounty programs

Security automation

Secure SDLC

Communication

Influencing

Engineering mindset

Tools

Python

Go

TypeScript

Job description

Mistral is seeking a Product Security Engineer to partner with product teams and embed security across the lifecycle from design to deployment. You will drive threat modeling, secure design patterns, and pragmatic security criteria to enable fast, safe delivery of features.

You will review designs and code for authentication, authorization, data protection and cryptography, while mentoring teams in secure practices and building reusable security platforms within the SDLC.