DomainTools

DNS-based threat intelligence platform for security

Solutions Engineer

Pre-Sales Solution EngineeringConfirmed live in the last 24 hours

Full-timeRemote in UKNo salary listed

About the Job

Requirements

At least 3 years of experience in a customer-facing technical role such as Solutions Engineer, Sales Engineer, Solutions Architect, Technical Account Manager, or as a threat intelligence or security operations center practitioner who has moved into presales.
Experience and knowledge of cybersecurity sufficient to communicate fluently with security buyers, including security operations center directors, threat intelligence leads, and chief information security officers.
Working knowledge of DNS, WHOIS/RDAP, passive DNS, SSL/TLS, HTTP, and how adversaries abuse internet infrastructure.
Hands-on experience with at least one security information and event management platform, one security orchestration, automation and response platform, and one threat intelligence platform, including building or debugging an integration.
Comfort with RESTful APIs, JSON, and scripting, preferably Python; ability to read code, prototype with it, and demonstrate it live.
Strong demonstration and whiteboarding skills, including constructing a compelling narrative from a blank browser tab.
Willingness to travel approximately 25% for customer meetings, events, and quarterly business reviews.

Responsibilities

Own discovery, technical qualification, solution design, demonstrations, and proofs of value for enterprise and strategic opportunities.
Translate customer challenges—including phishing, brand abuse, command-and-control discovery, third-party risk, fraud, digital forensics and incident response, threat hunting, and exposure management—into workflows using DomainTools products.
Design and defend integration architectures involving security information and event management, security orchestration, automation and response, threat intelligence platforms, extended detection and response, and data platforms, including customer-built systems.
Lead beginner-to-advanced training, onboarding, and education sessions to support adoption of the solution portfolio.
Serve as a trusted technical advisor from the first customer interaction through renewal.
Partner with Customer Success and Support to provide expert technical support and help ensure successful production deployment.
Conduct executive briefings and technical deep dives.
Provide customer feedback to Product and Engineering to inform the product roadmap.
Build reusable technical assets, including demonstration environments, integration recipes, IrisQL playbooks, MCP workflows, and reference architectures.
Partner with Account Executives on technical strategy, named-account plans, competitive positioning, executive relationships, and pipeline health.
Represent DomainTools at events, customer advisory boards, and practitioner communities.

Desired Qualifications

Prior experience at a threat intelligence, DNS, network security, or security operations center tooling vendor.
Experience with agentic or large language model-driven security workflows, MCP servers, or building on security data lakes.
Background as a former analyst, incident responder, threat hunter, or cyber threat intelligence practitioner.
Fluency in French or another European language.

Solutions Engineer

DomainTools · United Kingdom (Remote) · Full-time · Posted 2026-09-21

Workplace: remote

Department: Sales

Description

The internet is the world's most dangerous attack surface. DomainTools maps it — and we're moving faster than ever.

The world's most advanced security teams rely on DomainTools to identify malicious infrastructure before attacks happen. We're in an active growth phase: shipping new products, expanding our intelligence platform well beyond our DNS roots, and positioning our data at the center of where cybersecurity is heading in the age of AI.

Today, DomainTools delivers a comprehensive internet intelligence platform covering domains, IPs, hostnames, SSL certificates, passive DNS, real-time threat feeds, and AI-native integrations, with global visibility driven by massively scaled active and passive data observations. Our Iris Investigate platform, DNSDB / SIE passive DNS, real-time threat feeds, IrisQL, and newly launched MCP Server are the intelligence backbone for the most demanding security teams on earth.

We're hiring a Solutions Engineer to partner with our Account Executives, and Customer Success Managers for Europe. This is the technical face of DomainTools in front of the organisations we're built for. These are technical, skeptical, well-resourced buyers — the security teams at the world's largest financial institutions, governments, technology platforms, and defense organizations. They don't want a pitch. They want a peer.

You will own the technical win. You'll run discovery, design solutions, deliver demos that earn analyst respect on the first call, run POVs that produce evidence a customer can defend internally, and be the trusted technical peer through renewal and expansion.

You will have mentors and resources to assist with learning but your success will depend heavily on your ability to consume new information independently and using your initiative to reach out to experts within the organisation for specialist knowledge transfer.

Our platform is expanding fast — real-time threat feeds, IrisQL, the MCP Server for AI-native security workflows, deepening integrations with Splunk, CrowdStrike, Google SecOps, Anomali, Cortex XSOAR, and more. The SE team is where product velocity meets customer reality. You'll shape both.

Technical Wins

Own discovery, technical qualification, solution design, demo, and POV for enterprise and strategic opportunities.
Translate customer pain — phishing, brand abuse, C2 discovery, third-party risk, fraud, DFIR, threat hunting, exposure management — into concrete DomainTools workflows across Iris Investigate, DNSDB / Farsight passive DNS, real-time threat feeds, and the MCP Server.
Design and defend integration architectures with SIEM, SOAR, TIP, XDR, and data platforms (Splunk, CrowdStrike, Google SecOps, Palo Alto Cortex, Anomali, Elastic, Microsoft Sentinel, Snowflake, Databricks, and the customer's homegrown stack).
Lead focused beginner through advanced training, onboarding, and education sessions to guide adoption of our solution set.

Customer Advocacy

Be the technical trusted advisor from first call through renewal. The buyers in this seat are paranoid for good reason; earn the trust that gets you invited back.
Partner with Customer Success and Support to be a key provider of expert technical support and make sure the win on paper becomes a win in production.
Run executive briefings and technical deep-dives with equal fluency — the same day if needed.

Product & Market Feedback

Be the customer’s voice into Product and Engineering. Bring back the signal that shapes the roadmap.
Build reusable technical assets — demo environments, integration recipes, IrisQL playbooks, MCP workflows, reference architectures — that make the whole SE team better.

Regional Leadership

Partner with your AEs to build the technical strategy: named-account plans, competitive posture, executive relationships, and pipeline health.
Represent DomainTools at events, customer advisory boards, and practitioner communities.

Requirements

Must-haves

3+ years in a customer-facing technical role — Solutions Engineer, Sales Engineer, Solutions Architect, TAM, or a threat intel / SOC practitioner who has moved into pre-sales.
Experience and knowledge of the cybersecurity landscape that underpins a strong fluency with the security buyer. You can hold your own in a room with a SOC director, a threat intel lead, and a CISO — in the same meeting.
Working knowledge of DNS, WHOIS/RDAP, passive DNS, SSL/TLS, HTTP, and the fundamentals of how internet infrastructure is abused by adversaries.
Hands-on comfort with at least one SIEM, one SOAR, and one TIP. You've built or debugged an integration, not just talked about one.
Comfort with RESTful APIs, JSON, and scripting (Python preferred). You don't need to ship production code; you do need to read it, prototype with it, and demo it live.
Excellent demo and whiteboard skills. You can build a compelling narrative from a blank browser tab.
Willingness to travel ~25% for customer meetings, events, and QBRs.

Strong plus

Prior experience at a threat intelligence, DNS, network security, or SOC-tooling vendor.
Experience with agentic / LLM-driven security workflows, MCP servers, or building on top of security data lakes.
Background as a former analyst, incident responder, threat hunter, or CTI practitioner.
Fluency in French, or other European languages.

Apply

Apply at DomainTools

About the Company

DomainTools

DNS-based threat intelligence platform for security

DomainTools provides DNS-based threat intelligence for cybersecurity teams. Its Iris Intelligence Platform combines historical and real-time DNS, Whois, and infrastructure data to map attacker infrastructure, assess risk, and investigate threats. By adding Farsight's passive DNS data, it delivers billions of data points and predictive risk scores, into products like Iris Investigate, Iris Detect, and Iris Enrich that support threat hunting, phishing prevention, brand protection, and incident response. The data can be integrated with SIEMs and SOARs to enrich alerts, and the company targets over 700 enterprises including Fortune 100 firms, banks, tech companies, and government agencies through a subscription SaaS model and partner programs.

Company size: 51-200
Company stage: Not listed
Total funding: Not listed
Headquarters: Seattle, WA
Founded: 2004

Recently Posted Jobs

Explore more opportunities at DomainTools

See more jobs