Security Engineer

Mixpanel•San Francisco, CA

About The Position

Mixpanel’s Information Security & Risk Management (ISRM) team is hiring a hands-on Security Engineer to run day-to-day security operations, including vulnerability management, detection and monitoring, and incident response. The role works closely with engineering teams to identify and reduce risk, improve detection quality, and use AI to accelerate triage and investigation. It is intended for an engineer early to midway through their career, with a defined path to Senior Security Engineer. The position includes participating in the security on-call rotation. Success includes independently triaging findings and alerts, owning the vulnerability triage queue, improving noisy detections, responding to incidents, and shipping an AI-assisted workflow that measurably reduces triage or investigation time. As the role develops, the engineer may take on larger projects and grow toward Senior Security Engineer.

Requirements

3–5 years of experience in security engineering, security operations, detection and response, or a related role.
Hands-on vulnerability management experience, including triaging and validating scanner and penetration-test findings and working with engineers on remediation.
Experience using a SIEM, including writing queries and building or tuning detections.
Experience investigating and responding to security incidents.
Understanding of common attack techniques and how to detect them, for example using MITRE ATT&CK.
Working knowledge of cloud security in GCP or AWS, including IAM, audit logging, and common misconfigurations.
Scripting skills in Python, Go, or a similar language to automate tasks and work with log data.
Hands-on experience using AI tools to automate security workflows, or a strong interest in developing that skill.
Sound judgment on severity and risk, including knowing when to escalate and when an issue can wait.
Ability to explain security issues clearly to engineers and get fixes prioritized without unnecessarily slowing teams down.
Strong written communication and follow-through, with the ability to manage concurrent items and work independently.

Nice To Haves

Experience with detection-as-code, such as Sigma rules or version-controlled detections with CI testing.
Experience with EDR tools such as CrowdStrike or SentinelOne.
Experience with SOAR or workflow automation platforms such as Tines or Torq.
Experience with Kubernetes and container security.
Experience running or supporting a bug bounty program.
GCIH, GCIA, GCFA, OSCP, or similar certification.

Responsibilities

Triage vulnerability findings from scanners, penetration tests, bug bounty reports, and dependency tooling; validate exploitability and impact and assign severity.
Coordinate vulnerability remediation with engineering teams, agree on fixes and timelines, track items through closure within SLA, and escalate items at risk of missing the SLA.
Build, tune, and maintain SIEM detections across cloud, identity, endpoint, and application logs, reducing false positives.
Use AI tools to accelerate alert triage, enrich investigations, write and test detection logic, and automate repetitive security operations work.
Investigate and respond to security incidents from initial alert through containment, eradication, and recovery; write post-incident reviews with follow-up actions.
Identify gaps in log sources and detection coverage, onboard new sources, and maintain response runbooks.
Participate in the security on-call rotation.