GRC Specialist

Mixpanel•San Francisco, CA

About The Position

Mixpanel’s Information Security & Risk Management team is hiring a GRC Specialist to own the day-to-day operations of its governance, risk, and compliance function. The role is the first point of response for customer security requests and third-party risk work, helping keep work moving so senior analysts can focus on risk judgment. It is an entry point to a defined GRC career path, with the opportunity to grow into a GRC Analyst and eventually a Senior GRC Analyst. The specialist supports customer security questionnaires, vendor intake and risk tracking, incoming GRC request triage, compliance follow-up, and the accuracy of customer-facing security information. The role also uses AI tools to streamline recurring workflows and documents work so it can be reused by the team. The position calls for sound judgment, initiative, strong written communication, cross-functional coordination, and comfort working independently across time zones. Mixpanel states that compensation is total target cash compensation, including base and variable compensation. The US range is $116,000–$140,000, with eligibility for equity consideration and benefits including medical, vision, and dental coverage. Additional listed benefits include a mental wellness benefit, generous vacation and company holidays, enhanced parental leave, volunteer time off, pre-tax benefits including a 401(k), a wellness benefit, and a holiday break.

Requirements

1–2 years of experience in GRC, security compliance, vendor risk, or a related role.
Hands-on experience using AI tools, such as Claude Code or Claude Cowork, to automate repetitive GRC workflows.
Self-directed and resourceful, comfortable with ambiguity and making progress on incomplete requests with little direction; able to find information, ask follow-up questions, and know when to escalate.
Sound judgment and initiative, including making decisions within scope, identifying improvement opportunities, proposing solutions, and escalating larger changes.
Understanding of risk management processes and how risks are identified, assessed, and tracked across the third-party lifecycle, including due diligence, risk assessment, remediation tracking, and ongoing monitoring.
Baseline understanding of security systems and processes such as access management, logging, encryption, and vulnerability management.
Baseline understanding of audit processes and frameworks such as SOC 2 and ISO 27001, including evidence and control testing.
Ability to understand customer security requests and respond accurately, including interpreting loosely worded or unfamiliar questions.
Ability to translate audit and compliance requirements into clear, actionable requests for engineering teams.
Curiosity about security and compliance, motivation to learn and grow, and desire to build a career in GRC.
Comfort explaining and defending work with evidence when customers, vendors, engineers, or auditors challenge it, and treating review feedback as input for improvement.
Strong written communication and follow-through; ability to coordinate across teams, manage multiple concurrent items, and work independently across time zones.

Nice To Haves

Experience with Vanta or another GRC platform.
Experience with Freshservice or another ticketing system.
Experience with third-party risk management tools.
Scripting or no-code automation experience, such as Python or Zapier.
CompTIA Security+, ISO 27001 Lead Implementer, or a similar entry-level certification.

Responsibilities

Partner with teams across the company to complete customer security questionnaires and keep stakeholders informed of progress.
Support the third-party risk management program by running vendor intake, gathering and verifying security documentation, and tracking vendor status through review, remediation, and renewal.
Act as the first point of contact for incoming GRC requests, triage them, and escalate items requiring deeper review.
Follow up with control owners, vendors, and internal teams on open remediation and compliance items until they are closed.
Triage alerts from the compliance monitoring platform.
Keep customer-facing information current by identifying outdated or inconsistent content and driving corrections.
Use AI tools to streamline repetitive GRC workflows, identify improvement opportunities, and document work for team reuse.