Security Operations Engineer II - Austin, TX

Astronomer empowers data teams to bring mission-critical software, analytics, and AI to life and is the company behind Astro, the industry-leading unified DataOps platform powered by Apache Airflow®. Astro accelerates building reliable data products that unlock insights, unleash AI value, and powers data-driven applications. Trusted by more than 800 of the world's leading enterprises, Astronomer lets businesses do more with their data. To learn more, visit www.astronomer.io.

About this role

We’re building the foundation for how Information Systems and Security Operations run and scale across Astronomer. As an Security Operations Engineer II, you’ll operate at the intersection of IT, security, and data where you will be handling complex escalations, strengthening our baseline security, and turning one-off fixes into durable systems.

This role matters because it directly impacts how fast and safely we can grow. You’ll help define how we secure identity and infrastructure, respond to incidents, and how we use data to scope future initiatives.

In your first 6-12 months, you’ll help create the playbook to build repeatable processes and smarter workflows that ensure resilient and secure enterprise operations.

Ideally, you are a problem-solver who enjoys ambiguity and wants to grow across IT, SecOps, and GenAI automation. You’ll work on high-priority projects like AI/ML-enabled systems, data analytics and reporting for service health and incident response, and scalable improvements to vulnerability/patch operations.

Your successes will result in faster resolution, fewer repeat issues, higher signal-to-noise ratio in SecOps, and robust systems that get better as the company scales.

What you get to do:

• Own Tier 2 escalations across endpoints, identity & access, collaboration tools, and core services—balancing fast resolution with long-term quality.

• Investigate root causes of recurring issues and design durable fixes that prevent repeat incidents (vs. one-off workarounds).

• Develop secure configuration standards and baselines spanning endpoints, GenAI, orchestration, and SaaS/cloud infrastructure, and iterate on them to support scale and reliability.

• Shape incident/problem/change practices by proposing safe changes with clear rollback plans and improving how the team learns from incidents.

• Create operational documentation (knowledge base articles, runbooks, reusable patterns) that reduces escalations and uplevels the service desk.

• Triage and investigate security alerts in EDR/SIEM/SOAR, escalate effectively, and coordinate containment to recovery using playbooks with clear timelines.

• Build and improve automations + analytics (GenAI/ML workflows, scripts/APIs, dashboards) to streamline tasks like alert enrichment, ticket routing, lifecycle changes, remediation flows, and ongoing operational reporting.

• Partner on vulnerability and patch management by prioritizing issues, tracking remediation to SLAs, and verifying closure in measurable ways.

What you bring to the role:

• 2+ years of experience with Python (or similar scripting languages) and APIs.

• Strong troubleshooting skills across endpoints, identity/access, and collaboration platforms; owning issues through to resolution.

• Hands-on SecOps exposure using tools like EDR/SIEM/SOAR for alert triage, investigation, and incident handling (or closely related experience with the ability to ramp fast).

• Data and analytics mindset with comfort pulling, cleaning, and analyzing operational data (tickets, alerts, logs) to guide decisions.

• Automation capability using scripting (Python or similar), APIs, and/or orchestration—building safe, auditable workflows that may leverage GenAI/ML for enrichment or decision support.

• Clear communicator who stays calm under pressure, comfortable navigating ambiguity and proposing structured solutions.

• Demonstrated curiosity and learning agility, with interest in growing across IT, security, and data/automation.

Bonus points if you have:

• Background in data analytics or analytics-heavy roles (e.g., operations analytics, analytics engineering, or similar).

• Exposure to security frameworks or compliance requirements and how they translate into practical controls and processes.

• Experience in a fast-growing or high-change environment, helping bring order and structure to messy, evolving systems.

• Demonstrated Generative AI (LLM or Agentic) implementation projects or InfoSec experience.

The estimated total compensation for this role is $80,000 - $85,000, along with an equity component. This range is merely an estimate, and the width of the range reflects willingness to consider candidates with broad prior seniority. Actual compensation may deviate from this range based on skills, experience, and qualifications.

#LI-fulltime

At Astronomer, we value diversity. We are an equal opportunity employer: we do not discriminate on the basis of race, religion, color, national origin, gender, sexual orientation, age, marital status, veteran status, or disability status.