Forensics Specialist

Varonis

6d•Remote

About The Position

Varonis is seeking a motivated Forensics Specialist to join its Forensics team. The role contributes to cyber defense by leading incident response engagements and supporting forensic investigations, delivering breach response services to major customers. The specialist works with DFIR engineering and R&D teams, contributes to product development, and helps strengthen customer security. Candidates should have a background in digital forensics, incident response, and SOC operations. The position is part of a 24x7 follow-the-sun team and requires adaptability to a fluid schedule, including coverage beyond the standard work week. Candidates should be based in the Pacific Standard Time zone or be willing to work those hours.

Requirements

At least 4 years of experience working in Digital Forensics and Incident Response or SOC teams.
Knowledge of Windows and Linux forensic techniques, tools, and concepts.
Experience conducting enterprise-scale cybersecurity investigations, including ransomware, intrusion activity, and advanced persistent threats.
Experience providing defensible containment steps based on limited information and under time pressure.
Tool-agnostic mindset and ability to create ad hoc tools to support investigations of emerging threats.
Ability to work directly with clients and internal stakeholders during cyber incidents.
Strong technical foundation in IT concepts, languages, and services, including Active Directory, SQL, KQL, and the OSI model.
Experience with multiple enterprise security solutions, such as SIEMs, firewalls, IDPS, antivirus/EDR, IAM, and DLP.
Demonstrated success contributing to a team-oriented environment.
Excellent communication and interpersonal skills.
Strong critical thinking, deductive reasoning, problem-solving, and prioritization skills.
Ability to adapt to a fluid and dynamic schedule, including coverage during hours and days beyond the standard work week.

Nice To Haves

Experience with common cloud providers such as AWS, GCP, or Azure.
Experience performing incident response in platforms such as Salesforce or GitHub.
Experience performing incident response related to AI/LLM models, platforms, or agents.
Relevant industry certifications such as GCIH or GCFA.
Experience performing or presenting industry-relevant research.

Responsibilities

Become an essential member of the 24x7 follow-the-sun team.
Collaborate with stakeholders and customers to improve processes and products.
Use the Varonis platform and operational tools to perform high-quality analysis.
Independently lead and execute responses to high-profile cyber threat incidents in customer environments.
Conduct threat hunting using the Varonis platform and other SOC-related tools and platforms.
Contribute to knowledge bases through technical investigations and new findings, and implement best practices based on those insights.
Collaborate with engineering to enhance tool functionality and update investigation playbooks.
Serve as an internal and external cybersecurity subject matter expert to educate peers and customers when required.
Serve as technical lead on engagements, guiding investigations and forensic analysis.
Conduct advanced host, network, and hyperscaler investigations to identify root cause.
Collaborate with team members to deliver strong outcomes for clients.