Responsibilities
- Design, develop, maintain, and scale SOAR playbooks, workflows, and integrations across the MDR platform.
- Build and operate automation for alert triage, enrichment, investigation, containment, and response.
- Define automation strategy by identifying high-impact SOC processes and scaling them through automation.
- Develop integrations across SIEM, EDR/XDR, identity, cloud, and ticketing systems using APIs and scripting.
- Partner with MDR analysts, incident response, threat hunting, and engineering teams to translate operational workflows into automation.
- Improve detection and response quality and contribute tooling for incident response and root-cause analyses.
- Evaluate and implement AI-assisted workflows and data-driven decisioning capabilities.
- Define automation KPIs and build dashboards and reporting for automation coverage, MTTD/MTTR, false positives, analyst time saved, throughput, and SLA performance.
- Monitor workflow reliability, execution latency, integration and API health, errors, retries, logging, alerting, and observability.
- Continuously optimize workflows based on data, feedback, and operational performance.
Requirements
- At least 4 years of experience in security operations, MDR, incident response, or security engineering.
- At least 2–3 years of hands-on experience with SOAR platforms and security automation.
- Proven experience owning and operating production-grade automation workflows in a SOC or MDR environment.
- Strong understanding of SOC operations, alert triage, escalation workflows, and incident response.
- Experience with enterprise security technologies including SIEM, SOAR, EDR/XDR, and IAM/AD.
- Strong Python, PowerShell, and Bash scripting/development skills, including building APIs and integrations.
- Experience with CI/CD, Git, and deploying automation at scale.
- Strong analytical, problem-solving, communication, and collaboration skills.
- Preferred experience with AI-enhanced automation, large-scale workflow orchestration, high-volume MDR/SOC environments, threat hunting, or detection engineering.
Benefits
- Raleigh, North Carolina-area position with hybrid work indicated.
- Work supports 24x7x365 managed detection and response operations.
About Varonis
Varonis unifies AI-native data security, AI security and governance, and behavior-based threat detection. Core offerings include the Varonis Data Security Platform for AI-native data security, Varonis Atlas for safe and trustworthy AI, Varonis Next-Gen DAM for database security, and Varonis Interceptor for preventing AI-powered social engineering threats. Backed by 24×7×365 expert-led detection and response, Varonis enables organizations to confidently adopt AI, reduce data exposure, and simplify security operations in an evolving threat landscape. Trusted by thousands of leading global enterprises, Varonis is the partner security teams rely on to automatically and effortlessly protect their most critical data and safely accelerate AI innovation.