GRC Specialist

Mixpanel•San Francisco, CA

3d•$116,000 - $140,000

About The Position

Mixpanel’s Information Security & Risk Management team is hiring a GRC Specialist to own the day-to-day operations of its GRC function. The role is the first line of response for customer security requests and third-party risk work, helping keep requests moving so senior analysts can focus on risk judgment. It is a growth role with a defined path to GRC Analyst. The specialist will coordinate customer security questionnaires, support vendor intake and risk tracking, triage incoming GRC requests, follow up on open compliance and remediation items, and maintain accurate customer-facing security information. The role also uses AI tools to streamline recurring workflows and documents processes for the team to reuse. The position offers a progression toward GRC Analyst and, later, Senior GRC Analyst. Compensation is listed as total target cash compensation of $116,000–$140,000 USD, with eligibility for equity consideration and benefits. Mixpanel describes its culture through values including bold action, insight-driven decisions, collaboration, candor, customer focus, and simplicity.

Requirements

1–2 years of experience in GRC, security compliance, vendor risk, or a related role.
Hands-on experience using AI tools, such as Claude Code or Claude Cowork, to automate repetitive GRC workflows.
Self-directed and resourceful, comfortable with ambiguity, and able to make progress on incomplete requests with little direction, locate information, ask follow-up questions, and know when to escalate.
Sound judgment and initiative, including making decisions within scope, identifying improvements, proposing solutions, and escalating larger changes.
Understanding of risk management processes, including identifying, assessing, and tracking risks across the third-party lifecycle: due diligence, risk assessment, remediation tracking, and ongoing monitoring.
Baseline understanding of security systems and processes such as access management, logging, encryption, and vulnerability management.
Baseline understanding of audit processes and frameworks such as SOC 2 and ISO 27001, including evidence and control testing.
Ability to understand customer security requests and respond accurately, including interpreting loosely worded or unfamiliar questions.
Ability to translate audit and compliance requirements into clear, actionable requests for engineering teams.
Curiosity about security and compliance, motivation to learn and grow, and desire to build a career in GRC.
Comfort explaining and defending work with evidence when challenged by customers, vendors, engineers, or auditors, and using review feedback to improve.
Strong written communication and follow-through, with the ability to coordinate across teams, manage concurrent items, and work independently across time zones.

Nice To Haves

Experience with Vanta or another GRC platform.
Experience with Freshservice or another ticketing system.
Experience with third-party risk management tools.
Scripting or no-code automation experience, such as Python or Zapier.
CompTIA Security+, ISO 27001 Lead Implementer, or a similar entry-level certification.

Responsibilities

Partner with teams across the company to complete customer security questionnaires and keep stakeholders informed of progress.
Support the third-party risk management program by running vendor intake, gathering and verifying security documentation, and tracking vendors through review, remediation, and renewal.
Serve as the first point of contact for incoming GRC requests, triage requests, and escalate items requiring deeper review.
Follow up with control owners, vendors, and internal teams on open remediation and compliance items until they are closed.
Triage alerts from the compliance monitoring platform.
Keep customer-facing information current by flagging outdated or inconsistent content and driving corrections.
Use AI tools to streamline repetitive GRC workflows, identify improvement opportunities, and document work so the team can reuse it.