About the Role

Mixpanel's Information Security & Risk Management (ISRM) team is hiring a Security Engineer to run the day-to-day work of our security operations: vulnerability management, detection and monitoring, and incident response. You'll work closely with engineering teams to find and close real risk, tune our detections so every alert is worth investigating, and use AI to make triage and investigation faster. This is a hands-on role for an engineer early to mid-way in their career, with a defined path to Senior Security Engineer.

Responsibilities

• Vulnerability management: Triage findings from vulnerability scanners, penetration tests, bug bounty reports, and dependency tooling. Validate exploitability and impact in our environment, and assign severity accordingly.
• Remediation with engineering: Work with engineering teams to agree on fixes and timelines, track each vulnerability through to closure within SLA, and escalate items at risk of missing it.
• Detection and monitoring: Build, tune, and maintain detections in our SIEM across cloud, identity, endpoint, and application logs, and cut false positives so on-call time goes to real threats.
• AI-assisted security operations: Use AI tools (e.g. Claude Code) to speed up alert triage, enrich investigations, write and test detection logic, and automate repetitive SecOps work.
• Incident response: Investigate and respond to security incidents from first alert through containment, eradication, and recovery, and write clear post-incident reviews with follow-up actions.
• Coverage and runbooks: Identify gaps in log sources and detection coverage, onboard new sources, and keep runbooks current so the team responds consistently.
• On-call: Take part in the security on-call rotation.

We're Looking For Someone With

• 3-5 years of experience in security engineering, security operations, detection and response, or a related role
• Hands-on vulnerability management experience, including triaging and validating scanner and pentest findings and working with engineers to remediate them
• Experience working in a SIEM (e.g. Splunk, Google SecOps/Chronicle, Panther, Elastic), including writing queries and building or tuning detections
• Experience investigating and responding to security incidents
• Understanding of common attack techniques and how to detect them, for example using MITRE ATT&CK
• Working knowledge of cloud security in GCP or AWS, including IAM, audit logging, and common misconfigurations
• Scripting skills in Python, Go, or a similar language to automate tasks and work with log data
• Hands-on experience using AI tools (e.g. Claude Code) to automate security workflows, or a strong interest in building that skill
• Sound judgment on severity and risk, including knowing when to escalate and when an issue can wait
• Ability to explain security issues clearly to engineers and get fixes prioritized without slowing teams down unnecessarily
• Strong written communication and follow-through, with the ability to manage many concurrent items and work independently

Nice to Have

• Experience with detection-as-code (e.g. Sigma rules, version-controlled detections with CI testing)
• Experience with EDR tools (e.g. CrowdStrike, SentinelOne)
• Experience with SOAR or workflow automation platforms (e.g. Tines, Torq)
• Experience with Kubernetes and container security
• Experience running or supporting a bug bounty program
• GCIH, GCIA, GCFA, OSCP, or similar certification

What Success Looks Like

• First 3 months: You understand our environment, log sources, and vulnerability pipeline, triage incoming findings and alerts on your own, and have joined the on-call rotation.
• By 6 months: You own the vulnerability triage queue end-to-end, have tuned our noisiest detections to reduce false positives, and have led the response to incidents.
• By 12 months: You've shipped at least one AI-assisted workflow that measurably reduces triage or investigation time, added detections for coverage gaps you identified, and are taking on larger projects as you grow toward Senior Security Engineer.

Growth Path

This role is part of a defined security engineering career path. As you build experience, you can grow into Senior Security Engineer, where you'll set the direction of our detection and response program, lead complex incidents, and design security improvements with engineering teams.