Security Engineer

Security Engineer 
Location: We are seeking candidates who are EST or CST based. 

Join our team as a Security Specialist within our Varonis Security Operations and Forensics Group. As one of our elite cybersecurity engineers, you will be at the forefront of cyber defense, building the engineering capabilities that support our global Incident Response engagements. Your contribution will be pivotal in helping our team deliver exceptional response and forensic services to our customer base. DFIR Engineering builds and runs the platforms, automation, and infrastructure behind our 24/7/365 response practice, helping every delivery function work faster, more consistently, and at scale.

Your role will involve researching, designing, building, and supporting the tools and platforms our DFIR team relies on, taking each one from the problem behind a request to a reliable, running solution in the cloud. You'll work closely with our engineering, IT, DevOps, and R&D teams, contribute insight toward product development, and help set the standards that keep our tooling consistent and secure.

If you are passionate about cybersecurity, have a solid foundation in cloud and systems engineering, and bring a problem-solving mindset with experience or interest in DFIR, detection engineering, threat hunting, or SOC operations, this is the perfect opportunity to make an impact and advance your career.

• Design, build, and operate cloud-native tooling and automation, including effective AI-assisted automation, to remove manual effort from triage, investigation, coordination, and reporting.
• Build API-driven integrations and data pipelines, including parsing, normalization, and enrichment, that connect our core DFIR systems.
• Build and maintain standard project templates, CI/CD pipelines, and security controls, including secrets management, security review checks, secure data handling, and audit trails.
• Provision engagement environments on demand through infrastructure as code, covering evidence processing, storage, and analysis compute.
• Own the operational health of the tooling portfolio: inventory, monitoring, patching, vulnerability and dependency management, technical debt, and deliberate retirement.
• Respond to engineering incidents against published SLAs, including during live engagements, through a cross-region on-call rotation and post-incident reviews.
• Partner with corporate IT, DevOps, product, and detection engineering teams, and document what you build: architecture, runbooks, and SOPs.

• 2+ years in DevOps, cloud, or security engineering, building and operating production systems.
• Hands-on Azure experience across compute, storage, identity, networking, and monitoring.
• Working knowledge of how Kubernetes and microservices workloads run in production.
• Experience with infrastructure as code (Terraform or Bicep) and CI/CD pipelines, with security built in through DevSecOps best practices.
• Strong Python skills, with experience integrating APIs and building data pipelines that parse, transform, and enrich large datasets. Bash or PowerShell a plus.
• Experience with observability platforms, such as Elasticsearch, Prometheus, or Grafana, for monitoring, alerting, and troubleshooting.
• Critical thinking, creative problem solving, and a keen eye for detail, with the ability to think outside the box, question assumptions, and spot anomalies.
• Strong communication skills and proven success in a globally distributed team.

• DFIR background: Windows and Linux forensic artifacts, the incident response lifecycle, and evidence handling.
• Knowledge of forensic collection and endpoint visibility tools such as Velociraptor.
• Experience in SOC operations, detection engineering, threat hunting, or threat intelligence.
• Familiarity with system design patterns for building scalable, resilient services, such as event-driven and microservices architectures.
• Experience with enterprise iPaaS (Integration Platform as a Service) and automation platforms, such as Workato, to orchestrate workflows and connect systems across the business.
• Experience applying data analytics techniques, such as statistical analysis and anomaly detection, to uncover patterns in large datasets.
• Familiarity with enterprise security platforms (EDR, SIEM, M365 and Entra ID logs) as data sources.
• Experience with additional programming languages, or a track record of contributing to open-source projects.
• Relevant certifications such as AZ-400, GIAC GCIH, or GCFA.