Security Engineer

# Security Engineer Mixpanel  
· mixpanel.com Category:
Detection & Response

Location:

San Francisco## Quality of life

What the posting states. Hover or tap a perk to see the line it came from.
* Paid parental leave
* Equity About Mixpanel Mixpanel is the leading product intelligence and analytics platform, trusted by more than 29,000 companies to help understand how people use the products they build. By combining powerful analytics with AI that knows your business, Mixpanel helps teams see what’s working, diagnose what’s not, and decide what to build next. Learn more at  the Role Mixpanel's Information Security Risk Management (ISRM) team is hiring a Security Engineer to run the day-to-day work of our security operations: vulnerability management, detection and monitoring, and incident response.

You'll work closely with engineering teams to find and close real risk, tune our detections so every alert is worth investigating, and use AI to make triage and investigation faster. This is a hands-on role for an engineer early to mid-way in their career, with a defined path to Senior Security Engineer.

Responsibilities Vulnerability management:
Triage findings from vulnerability scanners, penetration tests, bug bounty reports, and dependency tooling. Validate exploitability and impact in our environment, and assign severity accordingly.

Remediation with engineering:
Work with engineering teams to agree on fixes and timelines, track each vulnerability through to closure within SLA, and escalate items at risk of missing it.

Detection and monitoring:
Build, tune, and maintain detections in our SIEM across cloud, identity, endpoint, and application logs, and cut false positives so on-call time goes to real threats.

AI-assisted security operations:
Use AI tools (e.g. Claude Code) to speed up alert triage, enrich investigations, write and test detection logic, and automate repetitive Sec Ops work.

Incident response:
Investigate and respond to security incidents from first alert through containment, eradication, and recovery, and write clear post-incident reviews with follow-up actions.

Coverage and runbooks:
Identify gaps in log sources and detection coverage, onboard new sources, and keep runbooks current so the team responds consistently.

On-call:
Take part in the security on-call rotation.

We're Looking For Someone With3-5 years of experience in security engineering, security operations, detection and response, or a related role Hands-on vulnerability management experience, including triaging and validating scanner and pentest findings and working with engineers to remediate them Experience working in a SIEM (e.g. Splunk, Google Sec Ops/Chronicle, Panther, Elastic), including writing queries and building or tuning detections

Experience investigating and responding to security incidents

Understanding of common attack techniques and how to detect them, for example using MITRE ATT CKWorking knowledge of cloud security in GCP or AWS, including IAM, audit logging, and common misconfigurationsScripting skills in Python, Go, or a similar language to automate tasks and work with log data Hands-on experience using AI tools (e.g. Claude Code) to automate security workflows, or a strong interest in building that skill

Sound judgment on severity and risk, including knowing when to escalate and when an issue can wait Ability to explain security issues clearly to engineers and get fixes prioritized without slowing teams down unnecessarily

Strong written communication and follow-through, with the ability to manage many concurrent items and work independently

Nice to Have

Experience with detection-as-code (e.g. Sigma rules, version-controlled detections with CI testing)

Experience with EDR tools (e.g. Crowd Strike, Sentinel…