About Mixpanel

Mixpanel is the leading product intelligence and analytics platform, trusted by more than 29,000 companies to help understand how people use the products they build. By combining powerful analytics with AI that knows your business, Mixpanel helps teams see what’s working, diagnose what’s not, and decide what to build next. Learn more at mixpanel.com.

About the Role

Mixpanel's Information Security & Risk Management (ISRM) team is hiring a Security Engineer to run the day-to-day work of our security operations: vulnerability management, detection and monitoring, and incident response. You'll work closely with engineering teams to find and close real risk, tune our detections so every alert is worth investigating, and use AI to make triage and investigation faster. This is a hands-on role for an engineer early to mid-way in their career, with a defined path to Senior Security Engineer.

Responsibilities

Vulnerability management: Triage findings from vulnerability scanners, penetration tests, bug bounty reports, and dependency tooling. Validate exploitability and impact in our environment, and assign severity accordingly.
Remediation with engineering: Work with engineering teams to agree on fixes and timelines, track each vulnerability through to closure within SLA, and escalate items at risk of missing it.
Detection and monitoring: Build, tune, and maintain detections in our SIEM across cloud, identity, endpoint, and application logs, and cut false positives so on-call time goes to real threats.
AI-assisted security operations: Use AI tools (e.g. Claude Code) to speed up alert triage, enrich investigations, write and test detection logic, and automate repetitive SecOps work.
Incident response: Investigate and respond to security incidents from first alert through containment, eradication, and recovery, and write clear post-incident reviews with follow-up actions.
Coverage and runbooks: Identify gaps in log sources and detection coverage, onboard new sources, and keep runbooks current so the team responds consistently.
On-call: Take part in the security on-call rotation.

We're Looking For Someone With

3-5 years of experience in security engineering, security operations, detection and response, or a related role
Hands-on vulnerability management experience, including triaging and validating scanner and pentest findings and working with engineers to remediate them
Experience working in a SIEM (e.g. Splunk, Google SecOps/Chronicle, Panther, Elastic), including writing queries and building or tuning detections
Experience investigating and responding to security incidents
Understanding of common attack techniques and how to detect them, for example using MITRE ATT&CK
Working knowledge of cloud security in GCP or AWS, including IAM, audit logging, and common misconfigurations
Scripting skills in Python, Go, or a similar language to automate tasks and work with log data
Hands-on experience using AI tools (e.g. Claude Code) to automate security workflows, or a strong interest in building that skill
Sound judgment on severity and risk, including knowing when to escalate and when an issue can wait
Ability to explain security issues clearly to engineers and get fixes prioritized without slowing teams down unnecessarily
Strong written communication and follow-through, with the ability to manage many concurrent items and work independently

Nice to Have

Experience with detection-as-code (e.g. Sigma rules, version-controlled detections with CI testing)
Experience with EDR tools (e.g. CrowdStrike, SentinelOne)
Experience with SOAR or workflow automation platforms (e.g. Tines, Torq)
Experience with Kubernetes and container security
Experience running or supporting a bug bounty program
GCIH, GCIA, GCFA, OSCP, or similar certification

What Success Looks Like

First 3 months: You understand our environment, log sources, and vulnerability pipeline, triage incoming findings and alerts on your own, and have joined the on-call rotation.
By 6 months: You own the vulnerability triage queue end-to-end, have tuned our noisiest detections to reduce false positives, and have led the response to incidents.