MDR Security Engineer
About The Position
Varonis MDR delivers 24x7x365 managed detection and response services to protect customer data through advanced detection, investigation, and response at scale. The MDR Security Engineer owns and scales the automation layer powering global MDR operations, building and operating production-grade systems that reduce manual workload, improve detection quality, and support consistent, high-quality incident response. This hands-on engineering role focuses on SOAR platforms, security operations, and automation design to improve efficiency, reliability, and response outcomes in a high-volume SOC environment. Candidates should be based in the Raleigh, North Carolina area.
Requirements
- At least 4 years of experience in Security Operations, MDR, Incident Response, or Security Engineering.
- At least 2–3 years of hands-on experience with SOAR platforms and security automation.
- Proven experience owning and operating production-grade automation workflows in a SOC/MDR environment.
- Strong understanding of SOC operations, alert triage, escalation workflows, and incident response.
- Experience with enterprise security technologies, including SIEM, SOAR, EDR/XDR, and IAM/AD.
- Strong scripting and development skills in Python, PowerShell, and/or Bash, with experience building APIs and integrations.
- Experience with CI/CD, version control (Git), and deploying automation at scale.
- Strong analytical thinking and problem-solving skills, including the ability to translate complex workflows into automation.
- Excellent communication and collaboration skills across engineering and operations teams.
- Candidates should be based in the Raleigh, North Carolina area.
Nice To Haves
- Experience with AI-enhanced automation or large-scale workflow orchestration.
- Experience in high-volume MDR/SOC environments.
- Familiarity with threat hunting or detection engineering.
Responsibilities
- Maintain the design, development, and lifecycle of SOAR playbooks, workflows, and integrations across the MDR platform.
- Build and operate production-grade automation systems for alert triage, enrichment, investigation, and response.
- Define and drive automation strategy by identifying high-impact, high-volume SOC processes and scaling them through automation.
- Develop integrations across SIEM, EDR/XDR, identity, cloud, and ticketing systems using APIs and scripting.
- Partner with MDR analysts, incident response, threat hunters, and engineering teams to translate operational workflows into scalable automation.
- Improve detection and response quality by automating enrichment, investigation, and containment workflows.
- Contribute to incident response and root-cause analyses by delivering tooling that improves investigation speed, accuracy, and consistency.
- Evaluate and implement new automation capabilities, including AI-assisted workflows and data-driven decision-making.
- Define and own automation KPIs, including automation coverage, MTTD/MTTR improvement, false-positive reduction, signal-to-noise improvement, analyst time saved, and throughput increase.
- Build and maintain dashboards and reporting to measure automation impact on SOC performance and SLAs.
- Ensure production reliability and stability by monitoring workflow success and failure rates and execution latency; tracking integration and API health, errors, and retries; and implementing logging, alerting, and observability across automation pipelines.
- Continuously optimize workflows based on data, feedback, and operational performance to support consistent 24/7 MDR operations.
Stand Out From the Crowd
Upload your resume and get instant feedback on how well it matches this job.
What This Job Offers
Job Type
Full-time
Career Level
Mid Level
Education Level
No Education Listed
