The job, in the employer's words
The internet is the world's most dangerous attack surface. DomainTools maps it — and we're moving faster than ever.
For more than 25 years, the world's most advanced security teams have relied on DomainTools to identify malicious infrastructure before attacks happen. This is not a company coasting on legacy. We're in an active growth phase: shipping new products, expanding our intelligence platform well beyond our DNS roots, and positioning our data at the center of where cybersecurity is heading in the age of AI.
Today, DomainTools delivers a comprehensive internet intelligence platform covering domains, IPs, hostnames, SSL certificates, passive DNS, real-time threat feeds, and AI-native integrations, with global visibility driven by massively scaled active and passive data observations. Our Iris Investigate platform, DNSDB / Farsight passive DNS, real-time threat feeds, IrisQL, and newly launched MCP Server are the intelligence backbone for the most demanding security teams on earth.
We're not a startup chasing a trend. We're the category, and we're accelerating.
We're hiring a Solutions Engineer to partner with our Enterprise and Strategic Account Executives in North America. This is the technical face of DomainTools in front of the organizations we're built for. These are technical, skeptical, well-resourced buyers — the security teams at the world's largest financial institutions, governments, technology platforms, and defense organizations. They don't want a pitch. They want a peer. That's the seat.
You will own the technical win. You'll run discovery, design solutions, deliver demos that earn analyst respect on the first call, run POVs that produce evidence a customer can defend internally, and be the trusted technical peer through renewal and expansion.
Our platform is expanding fast — real-time threat feeds, IrisQL, the MCP Server for AI-native security workflows, deepening integrations with Splunk, CrowdStrike, Google SecOps, Anomali, Cortex XSOAR, and more. The SE team is where product velocity meets customer reality. You'll shape both.
What You'll Own
Technical Wins
- Own discovery, technical qualification, solution design, demo, and POV for enterprise and strategic opportunities.
- Translate customer pain — phishing, brand abuse, C2 discovery, third-party risk, fraud, DFIR, threat hunting, exposure management — into concrete DomainTools workflows across Iris Investigate, DNSDB / Farsight passive DNS, real-time threat feeds, and the MCP Server.
- Design and defend integration architectures with SIEM, SOAR, TIP, XDR, and data platforms (Splunk, CrowdStrike, Google SecOps, Palo Alto Cortex, Anomali, Elastic, Microsoft Sentinel, Snowflake, Databricks, and the customer's homegrown stack).
Customer Advocacy
- Be the technical trusted advisor from first call through renewal. The buyers in this seat are paranoid for good reason; earn the trust that gets you invited back.
- Partner with Customer Success and Support to make sure the win on paper becomes a win in production.
- Run executive briefings and technical deep-dives with equal fluency — the same day if needed.
Product & Market Feedback
- Be the field's voice into Product and Engineering. Bring back the signal that shapes the roadmap.
- Build reusable technical assets — demo environments, integration recipes, IrisQL playbooks, MCP workflows, reference architectures — that make the whole SE team better.
Regional Leadership
- Partner with your AEs to build the technical strategy: named-account plans, competitive posture, executive relationships, and pipeline health.
- Represent DomainTools at events, customer advisory boards, and practitioner communities.
Requirements
Must-haves
- 4+ years in a customer-facing technical role — Solutions Engineer, Sales Engineer, Solutions Architect, TAM, or a threat intel / SOC practitioner who has moved into pre-sales.
- Fluency with the security buyer. You can hold your own in a room with a SOC director, a threat intel lead, and a CISO — in the same meeting.
- Working knowledge of DNS, WHOIS/RDAP, passive DNS, SSL/TLS, HTTP, and the fundamentals of how internet infrastructure is abused by adversaries.
- Hands-on comfort with at least one SIEM, one SOAR, and one TIP. You've built or debugged an integration, not just talked about one.
- Comfort with RESTful APIs, JSON, and scripting (Python preferred). You don't need to ship production code; you do need to read it, prototype with it, and demo it live.
- Excellent demo and whiteboard skills. You can build a compelling narrative from a blank browser tab.
- Willingness to travel ~25% for customer meetings, events, and QBRs.
Strong plus
- Prior experience at a threat intelligence, DNS, network security, or SOC-tooling vendor.
- Experience with agentic / LLM-driven security workflows, MCP servers, or building on top of security data lakes.
- Familiarity with federal, DoD, IC, or allied-government buying motions and accreditation requirements (FedRAMP, IL4/5, IRAP, and equivalents).
- Background as a former analyst, incident responder, threat hunter, or CTI practitioner.
Benefits
DomainTools is the global leader for Internet intelligence and the first place security practitioners go when they need to know. The world’s most advanced security teams use our solutions to identify external risks, investigate threats, and proactively protect their organizations in a constantly evolving threat landscape. DomainTools constantly monitors the Internet and brings together the most comprehensive and trusted domain website and DNS data to provide immediate context and machine-learning driven risk analytics delivered in near real-time.
DomainTools offers a comprehensive benefits package to our employees that includes fully paid medical, dental and vision insurance premiums, a 401k retirement plan with company matching, basic life insurance, flexible PTO and additional well-being benefits.
DomainTools embraces diversity, equity and inclusion to its fullest as an equal opportunity employer. We build our teams so creativity and innovation can flourish. We believe inclusivity and equity fosters innovation and growth, and we harness this mindset to drive a culture that serves our employees and our customers. We encourage people of all backgrounds, ages, perspectives and skill sets to apply; and do not discriminate based on age, religion, color, national origin, gender, sexual orientation, gender identity, marital status, veteran status, disability or any other characteristic protected by law.
Requirements mentioned
- 4+ years in a customer-facing technical role — Solutions Engineer, Sales Engineer, Solutions Architect, TAM, or a threat intel / SOC practitioner who has moved into pre-sales.
- Fluency with the security buyer. You can hold your own in a room with a SOC director, a threat intel lead, and a CISO — in the same meeting.
- Working knowledge of DNS, WHOIS/RDAP, passive DNS, SSL/TLS, HTTP, and the fundamentals of how internet infrastructure is abused by adversaries.
- Hands-on comfort with at least one SIEM, one SOAR, and one TIP. You've built or debugged an integration, not just talked about one.
- Comfort with RESTful APIs, JSON, and scripting (Python preferred). You don't need to ship production code; you do need to read it, prototype with it, and demo it live.
- Excellent demo and whiteboard skills. You can build a compelling narrative from a blank browser tab.
- Willingness to travel ~25% for customer meetings, events, and QBRs.
No Mondays shows this listing as the employer published it. Check the details on the employer's site before you apply.