Security Engineer
Location: We are seeking candidates who are EST or CST based.
Join our team as a Security Specialist within our Varonis Security Operations and Forensics Group. As one of our elite cybersecurity engineers, you will be at the forefront of cyber defense, building the engineering capabilities that support our global Incident Response engagements. Your contribution will be pivotal in helping our team deliver exceptional response and forensic services to our customer base. DFIR Engineering builds and runs the platforms, automation, and infrastructure behind our 24/7/365 response practice, helping every delivery function work faster, more consistently, and at scale.
Your role will involve researching, designing, building, and supporting the tools and platforms our DFIR team relies on, taking each one from the problem behind a request to a reliable, running solution in the cloud. You'll work closely with our engineering, IT, DevOps, and R&D teams, contribute insight toward product development, and help set the standards that keep our tooling consistent and secure.
If you are passionate about cybersecurity, have a solid foundation in cloud and systems engineering, and bring a problem-solving mindset with experience or interest in DFIR, detection engineering, threat hunting, or SOC operations, this is the perfect opportunity to make an impact and advance your career.
Responsibilities- Design, build, and operate cloud-native tooling and automation, including effective AI-assisted automation, to remove manual effort from triage, investigation, coordination, and reporting.
- Build API-driven integrations and data pipelines, including parsing, normalization, and enrichment, that connect our core DFIR systems.
- Build and maintain standard project templates, CI/CD pipelines, and security controls, including secrets management, security review checks, secure data handling, and audit trails.
- Provision engagement environments on demand through infrastructure as code, covering evidence processing, storage, and analysis compute.
- Own the operational health of the tooling portfolio: inventory, monitoring, patching, vulnerability and dependency management, technical debt, and deliberate retirement.
- Respond to engineering incidents against published SLAs, including during live engagements, through a cross-region on-call rotation and post-incident reviews.
- Partner with corporate IT, DevOps, product, and detection engineering teams, and document what you build: architecture, runbooks, and SOPs.
- 2+ years in DevOps, cloud, or security engineering, building and operating production systems.
- Hands-on Azure experience across compute, storage, identity, networking, and monitoring.
- Working knowledge of how Kubernetes and microservices workloads run in production.
- Experience with infrastructure as code (Terraform or Bicep) and CI/CD pipelines, with security built in through DevSecOps best practices.
- Strong Python skills, with experience integrating APIs and building data pipelines that parse, transform, and enrich large datasets. Bash or PowerShell a plus.
- Experience with observability platforms, such as Elasticsearch, Prometheus, or Grafana, for monitoring, alerting, and troubleshooting.
- Critical thinking, creative problem solving, and a keen eye for detail, with the ability to think outside the box, question assumptions, and spot anomalies.
- Strong communication skills and proven success in a globally distributed team.
- DFIR background: Windows and Linux forensic artifacts, the incident response lifecycle, and evidence handling.
- Knowledge of forensic collection and endpoint visibility tools such as Velociraptor.
- Experience in SOC operations, detection engineering, threat hunting, or threat intelligence.
- Familiarity with system design patterns for building scalable, resilient services, such as event-driven and microservices architectures.
- Experience with enterprise iPaaS (Integration Platform as a Service) and automation platforms, such as Workato, to orchestrate workflows and connect systems across the business.
- Experience applying data analytics techniques, such as statistical analysis and anomaly detection, to uncover patterns in large datasets.
- Familiarity with enterprise security platforms (EDR, SIEM, M365 and Entra ID logs) as data sources.
- Experience with additional programming languages, or a track record of contributing to open-source projects.
- Relevant certifications such as AZ-400, GIAC GCIH, or GCFA.
Skills Required
- 2+ years of experience in DevOps, cloud engineering, or security engineering building and operating production systems
- Hands-on experience with Azure compute, storage, identity, networking, and monitoring
- Working knowledge of Kubernetes and microservices workloads in production
- Experience with infrastructure as code using Terraform or Bicep
- Experience with CI/CD pipelines and DevSecOps practices
- Strong Python skills, including API integrations and data pipelines for parsing, transforming, and enriching large datasets
- Experience with observability platforms such as Elasticsearch, Prometheus, or Grafana
- Strong communication skills and success working in globally distributed teams
- Bash or PowerShell experience
- DFIR experience with Windows and Linux forensic artifacts, incident response, and evidence handling
- Experience with Velociraptor or similar forensic collection and endpoint visibility tools
- Experience in SOC operations, detection engineering, threat hunting, or threat intelligence
- Experience with event-driven and microservices architectures
- Experience with Workato or other enterprise integration and automation platforms
- Experience applying statistical analysis or anomaly detection to large datasets
- Experience with EDR, SIEM, Microsoft 365, and Entra ID logs
- Relevant certifications such as AZ-400, GIAC GCIH, or GCFA
Varonis Compensation & Benefits Highlights
The following summarizes recurring compensation and benefits themes identified from responses generated by popular LLMs to common candidate questions about Varonis and has not been reviewed or approved by Varonis.
-
Healthcare Strength — Healthcare coverage is positioned as comprehensive, including medical, dental, and vision options that start immediately in some locations. The package is frequently characterized as a strong part of the overall rewards offering alongside other core benefits.
-
Retirement Support — Retirement benefits include a 401(k) with company matching (or a pension plan by region), which strengthens the long-term value of the package. Participation is complemented by additional ownership programs that increase total-rewards attractiveness.
-
Equity Value & Accessibility — Equity-related rewards such as stock options and an employee stock purchase plan (ESPP) are a notable part of the total compensation mix. These elements are often cited as helping offset middling perceptions of base pay, especially where equity participation is accessible.
Varonis Insights
What We Do
Varonis is a pioneer in data security and analytics, fighting a different battle than conventional cybersecurity companies. Varonis focuses on protecting enterprise data on premises and in the cloud: sensitive files and emails; confidential customer, patient and employee data; financial records; strategic and product plans; and other intellectual property. The Varonis Data Security Platform detects insider threats and cyberattacks by analyzing data, account activity, perimeter telemetry, and user behavior; prevents and limits disaster by discovering, classifying and locking down sensitive, regulated and stale data; and efficiently sustains a secure state with automation. With a focus on data security, Varonis serves a variety of use cases including data protection, threat detection and response, and compliance. Varonis started operations in 2005 and, as of December 31, 2018, had approximately 6,600 customers worldwide — comprised of industry leaders in many sectors including technology, consumer, retail, financial services, healthcare, manufacturing, energy, media, and education.
