Forensics Specialist

Varonis

6d•Remote

About The Position

Varonis is seeking a motivated Forensics Specialist to join its Forensics team. The role is part of an elite cybersecurity team, leading incident response engagements and supporting forensic investigations. The position contributes to breach response services for large customers and works with DFIR engineering and R&D teams on product development and customer security. Candidates should be based in the Eastern Standard Time zone. The role is marked as remote. The specialist leads cyber threat investigations and forensic analysis in customer environments, conducts threat hunting, and performs advanced host, network, and hyperscaler investigations to determine root cause. The role also supports knowledge-base development, investigation playbooks, tooling improvements, and education for colleagues and customers. The team operates as a 24x7 follow-the-sun team, and the specialist must be able to adapt to hours and days beyond the standard work week.

Requirements

At least 4 years of experience working in Digital Forensics and Incident Response or SOC teams.
Knowledge of Windows and Linux forensic techniques, tools, and concepts.
Experience executing enterprise-scale cybersecurity investigations, including ransomware, intrusion activity, and advanced persistent threats.
Experience providing defensible containment steps based on limited information and under time pressure.
Tool-agnostic approach and ability to create ad-hoc tooling to support investigations of emerging threats.
Ability to work directly with clients and internal stakeholders during cyber incidents.
Strong technical foundation in standard IT concepts, languages, and services, including Active Directory, SQL, KQL, and the OSI model.
Experience working with multiple enterprise security solutions, such as SIEMs, firewalls, IDPS, AV/EDRs, IAM, and DLP.
Proven success contributing to a team-oriented environment.
Excellent communication and interpersonal skills.
Strong critical thinking, deductive reasoning, problem-solving, and prioritization skills.
Ability to adapt to a fluid and dynamic schedule, including coverage during hours and days beyond the standard work week.

Nice To Haves

Experience with common cloud technology providers such as AWS, GCP, or Azure.
Experience performing incident response on platforms such as Salesforce or GitHub.
Experience performing incident response related to AI/LLM models, platforms, or agents.
Relevant industry certifications such as GCIH or GCFA.
Experience performing or presenting industry-relevant research.

Responsibilities

Become an essential member of the 24x7 follow-the-sun team.
Collaborate with key stakeholders and customers to improve processes and products.
Use the Varonis platform and operational tooling to perform high-quality analysis.
Independently lead and execute responses to high-profile cyber threat incidents in customer environments.
Conduct threat hunting using the Varonis platform and other SOC-related tools and platforms.
Contribute to knowledge bases through detailed technical investigations and discovery of new findings, and implement best practices based on those insights.
Collaborate with the engineering team to enhance tool functionality and update investigation playbooks.
Serve as a Cyber Security Subject Matter Expert internally and externally to educate peers and customers when required.
Serve as Technical Lead on engagements, guiding investigations and forensic analysis.
Execute advanced host, network, and hyperscaler investigations to identify root cause.
Collaborate with team members to provide strong delivery outcomes for clients.