Security Engineer

Mixpanel•San Francisco, CA

1d•$160,000 - $210,000

About The Position

Mixpanel’s Information Security & Risk Management (ISRM) team is hiring a hands-on Security Engineer to manage day-to-day security operations, including vulnerability management, detection and monitoring, and incident response. The role works closely with engineering teams to identify and address meaningful risk, improve detections, and use AI to accelerate triage and investigation. It is intended for an engineer early to mid-way in their career, with a defined path to Senior Security Engineer. The successful candidate will manage vulnerability findings from identification through remediation, develop and tune SIEM detections, respond to security incidents, improve logging and detection coverage, maintain runbooks, and participate in the security on-call rotation. The role offers a growth path toward taking on larger projects and eventually helping direct Mixpanel’s detection and response program.

Requirements

3–5 years of experience in security engineering, security operations, detection and response, or a related role.
Hands-on vulnerability management experience, including triaging and validating scanner and penetration-test findings and working with engineers on remediation.
Experience using a SIEM such as Splunk, Google SecOps/Chronicle, Panther, or Elastic, including writing queries and building or tuning detections.
Experience investigating and responding to security incidents.
Understanding of common attack techniques and their detection, for example using MITRE ATT&CK.
Working knowledge of cloud security in GCP or AWS, including IAM, audit logging, and common misconfigurations.
Scripting skills in Python, Go, or a similar language to automate tasks and work with log data.
Hands-on experience using AI tools such as Claude Code to automate security workflows, or a strong interest in building this skill.
Sound judgment on severity and risk, including knowing when to escalate and when an issue can wait.
Ability to explain security issues clearly to engineers and get fixes prioritized without unnecessarily slowing teams down.
Strong written communication and follow-through, with the ability to manage many concurrent items and work independently.

Nice To Haves

Experience with detection-as-code, such as Sigma rules or version-controlled detections with CI testing.
Experience with EDR tools such as CrowdStrike or SentinelOne.
Experience with SOAR or workflow automation platforms such as Tines or Torq.
Experience with Kubernetes and container security.
Experience running or supporting a bug bounty program.
GCIH, GCIA, GCFA, OSCP, or similar certification.

Responsibilities

Triage vulnerability findings from scanners, penetration tests, bug bounty reports, and dependency tooling; validate exploitability and impact, and assign severity.
Work with engineering teams to agree on vulnerability fixes and timelines, track issues through closure within SLA, and escalate items at risk of missing the SLA.
Build, tune, and maintain SIEM detections across cloud, identity, endpoint, and application logs, reducing false positives.
Use AI tools to accelerate alert triage, enrich investigations, write and test detection logic, and automate repetitive security operations work.
Investigate and respond to security incidents from initial alert through containment, eradication, and recovery; write post-incident reviews with follow-up actions.
Identify gaps in log sources and detection coverage, onboard new sources, and maintain current runbooks.
Participate in the security on-call rotation.