ISS Engineer (Tier 2)

Astronomer • Austin, TX

1d • $80,000 - $85,000

About The Position

Astronomer empowers data teams to bring mission-critical software, analytics, and AI to life and is the company behind Astro, the industry-leading unified DataOps platform powered by Apache Airflow®. Astro accelerates building reliable data products that unlock insights, unleash AI value, and powers data-driven applications. Trusted by more than 800 of the world's leading enterprises, Astronomer lets businesses do more with their data. To learn more, visit www.astronomer.io.
About this role
We’re building the foundation for how Information Systems and Security Operations run and scale across Astronomer. As an ISS Engineer, you’ll operate at the intersection of IT, security, and data where you will be handling complex escalations, strengthening our baseline security, and turning one-off fixes into durable systems.
This role matters because it directly impacts how fast and safely we can grow. You’ll help define how we secure identity and infrastructure, respond to incidents, and how we use data to scope future initiatives.
In your first 6-12 months, you’ll help create the playbook to build repeatable processes and smarter workflows that ensure resilient and secure enterprise operations.
Ideally, you are a problem-solver who enjoys ambiguity and wants to grow across IT, SecOps, and GenAI automation. You’ll work on high-priority projects like AI/ML-enabled systems, data analytics and reporting for service health and incident response, and scalable improvements to vulnerability/patch operations.
Your successes will result in faster resolution, fewer repeat issues, higher signal-to-noise ratio in SecOps, and robust systems that get better as the company scales.

Requirements

• 2+ years of experience with Python (or similar scripting languages) and APIs.
• Strong troubleshooting skills across endpoints, identity/access, and collaboration platforms; owning issues through to resolution.
• Hands-on SecOps exposure using tools like EDR/SIEM/SOAR for alert triage, investigation, and incident handling (or closely related experience with the ability to ramp fast).
• Data and analytics mindset with comfort pulling, cleaning, and analyzing operational data (tickets, alerts, logs) to guide decisions.
• Automation capability using scripting (Python or similar), APIs, and/or orchestration—building safe, auditable workflows that may leverage GenAI/ML for enrichment or decision support.
• Clear communicator who stays calm under pressure, comfortable navigating ambiguity and proposing structured solutions.
• Demonstrated curiosity and learning agility, with interest in growing across IT, security, and data/automation.

Nice To Haves

• Background in data analytics or analytics-heavy roles (e.g., operations analytics, analytics engineering, or similar).
• Exposure to security frameworks or compliance requirements and how they translate into practical controls and processes.
• Experience in a fast-growing or high-change environment, helping bring order and structure to messy, evolving systems.
• Demonstrated Generative AI (LLM or Agentic) implementation projects or InfoSec experience.

Responsibilities

• Own Tier 2 escalations across endpoints, identity & access, collaboration tools, and core services—balancing fast resolution with long-term quality.
• Investigate root causes of recurring issues and design durable fixes that prevent repeat incidents (vs. one-off workarounds).
• Develop secure configuration standards and baselines spanning endpoints, GenAI, orchestration, and SaaS/cloud infrastructure, and iterate on them to support scale and reliability.
• Shape incident/problem/change practices by proposing safe changes with clear rollback plans and improving how the team learns from incidents.
• Create operational documentation (knowledge base articles, runbooks, reusable patterns) that reduces escalations and uplevels the service desk.
• Triage and investigate security alerts in EDR/SIEM/SOAR, escalate effectively, and coordinate containment to recovery using playbooks with clear timelines.
• Build and improve automations + analytics (GenAI/ML workflows, scripts/APIs, dashboards) to streamline tasks like alert enrichment, ticket routing, lifecycle changes, remediation flows, and ongoing operational reporting.
• Partner on vulnerability and patch management by prioritizing issues, tracking remediation to SLAs, and verifying closure in measurable ways.

What This Job Offers

• Job Type: Full-time
• Career Level: Mid Level
• Education Level: No Education Listed
• Number of Employees: 251-500 employees