Senior Security Engineer

Relativity is hiring a Senior Security Engineer to build and improve behavioral detection capabilities focused on entity and user behavior analytics (EUBA) and non-human identity behavior analytics (NHIBA). This hybrid role in Illinois will support security operations through telemetry integration, behavioral baselining, automated investigation workflows, and scalable analytics.

Role Overview

In this position, you will design, deploy, and tune behavioral platforms that correlate identity, endpoint, application, cloud, API, and privileged-access telemetry. You will develop anomaly detections and behavioral risk models, validate detection performance, and operationalize findings across SIEM, XDR, SOAR, identity threat detection and response, and case-management workflows.

Key Responsibilities

• Design, deploy, integrate, and optimize platforms and capabilities for Entity and User Behavior Analytics and Non-Human Identity Behavior Analytics.
• Aggregate and normalize telemetry from identity providers, endpoints, applications, cloud platforms, APIs, privileged-access systems, service accounts, secrets platforms, and automated workloads.
• Develop and maintain behavioral baselines for workforce users, privileged identities, service accounts, machine identities, applications, agents, and other automated entities.
• Engineer analytics to detect anomalous access, credential misuse, privilege escalation, unusual resource interaction, abnormal execution patterns, lateral movement, and deviations from expected identity behavior.
• Develop behavioral risk models using identity sensitivity, privilege, asset context, access patterns, threat intelligence, and observed activity.
• Evaluate detection performance, false-positive rates, behavioral model drift, telemetry quality, and coverage gaps, then continuously tune analytics for improved precision and operational value.
• Integrate behavioral findings into SIEM, XDR, SOAR, identity threat detection and response, and case-management workflows.
• Serve as a technical escalation point for complex behavioral anomalies involving both human and non-human identities.
• Lead discovery and monitoring methods for non-human identities across cloud, SaaS, on-premises, development, and automation environments.
• Analyze authentication, authorization, privilege use, credential activity, token use, secrets access, API behavior, workload communication, and resource-interaction patterns.
• Develop detections for dormant or abandoned identities, shared credentials, unexpected privilege use, credential rotation failures, unauthorized token activity, anomalous service-account behavior, and deviations from intended identity purpose.
• Correlate identity behavior with ownership, business purpose, privilege level, application dependencies, data sensitivity, asset exposure, and lifecycle status.
• Partner with IAM, PAM, IT, Engineering, application owners, and platform teams to improve telemetry, identity attribution, ownership data, and remediation workflows.
• Automate investigation, enrichment, risk scoring, containment, credential rotation, access restriction, and escalation for high-confidence anomalies.
• Define and monitor measures including identity coverage, attributable ownership, behavioral-baseline coverage, detection precision, anomaly investigation time, remediation performance, and reduction of unmanaged or high-risk non-human identities.
• Correlate identity, endpoint, network, application, cloud, data, and access telemetry to identify activity that appears legitimate within a single control domain but becomes suspicious when viewed across the environment.
• Design behavioral detections that account for entity relationships, privilege, asset sensitivity, historical activity, peer-group behavior, and expected business use.
• Validate that security telemetry is sufficiently complete, timely, contextualized, and attributable to support reliable behavioral analytics; identify visibility gaps that limit monitoring.
• Translate threat intelligence, incident findings, purple-team results, and emerging attack techniques into behavioral hypotheses and analytics.
• Conduct control-efficacy testing to validate that detections identify identity misuse, credential compromise, privilege abuse, lateral movement, and automated workload anomalies.
• Provide technical recommendations on telemetry architecture, analytics platforms, behavioral models, and response controls; ensure behavioral analytics complement preventive controls.
• Lead hypothesis-driven threat hunts involving anomalous human and non-human identity behavior, including credential misuse, privilege abuse, token theft, lateral movement, service-account compromise, and malicious automation.
• Develop and document hunts mapped to MITRE ATT&CK, identity attack techniques, current threat intelligence, and observed behavioral patterns.
• Investigate behavioral outliers using root-cause analysis, timeline reconstruction, entity relationship mapping, and validation with identity or application owners; standardize hunts and outcomes.
• Convert successful hunts, incidents, purple-team findings, and emerging attack patterns into durable analytics, risk models, and automated response logic.
• Build and maintain automated workflows that enrich anomalies with identity, asset, privilege, ownership, application, threat-intelligence, and historical activity context.
• Automate triage, risk scoring, case creation, stakeholder validation, containment, credential rotation, access restriction, and escalation for behavioral detections.
• Evaluate and operationalize statistical, machine-learning, graph, peer-group, and AI-assisted techniques for anomaly detection and behavioral analysis.
• Define validation methods for analytics and models, including precision, recall, false-positive rate, detection latency, coverage, model drift, and analyst feedback.
• Apply explainability and supporting evidence so findings can be understood, investigated, and acted upon.
• Establish safeguards, monitoring, and human-review requirements for automated investigation or response actions.
• Measure and continuously improve the effect of behavioral analytics and automation on detection time, investigation time, containment time, analyst effort, and threat-actor dwell time.
• Mentor junior and mid-level security engineers and provide day-to-day escalation for technical approach, tooling, and professional development.
• Lead technical design and implementation of behavioral analytics, identity detection, telemetry integration, and automated response initiatives, producing architecture documentation, detection specifications, runbooks, and knowledge artifacts.
• Participate in hiring processes including technical interviews and candidate assessments.
• Represent security engineering in cross-functional technical discussions, translating security requirements and findings for engineering peers and non-technical stakeholders.

Required Qualifications

• 4–8 years of hands-on experience in security engineering, detection engineering, identity security, threat hunting, security analytics, or a related discipline.
• Demonstrated experience developing behavioral analytics, anomaly detections, correlation logic, threat-hunting queries, or risk-scoring methods from security telemetry.
• Experience analyzing activity associated with workforce identities, privileged accounts, service accounts, machine identities, applications, APIs, or cloud workloads.
• Hands-on experience with SIEM, XDR, UEBA/EUBA, identity threat detection and response, SOAR, or comparable security analytics platforms.
• Strong understanding of authentication, authorization, privilege, credentials, tokens, secrets, service accounts, workload identities, and common identity-based attack techniques.
• Experience integrating and analyzing telemetry from identity providers, endpoints, cloud platforms, applications, privileged-access systems, and other enterprise security technologies.
• Proficiency in at least one query, scripting, or programming language such as KQL, SPL, SQL, Python, PowerShell, or equivalent.
• Experience measuring and tuning detection efficacy, including false-positive reduction, coverage analysis, validation, and operationalization of findings.
• Demonstrated experience leading complex security initiatives through design, implementation, testing, stakeholder coordination, and operational adoption.
• Ability to communicate analytical findings, behavioral risk, and technical recommendations to engineering teams, system owners, security analysts, and non-technical stakeholders.
• Relevant certifications such as CySA+, SSCP, Security+, or equivalent in security analytics, cloud security, identity security, incident response, or security engineering.
• Prior experience mentoring or providing technical guidance to junior engineers.

Technologies

• SIEM, XDR, SOAR
• UEBA/EUBA
• KQL, SPL, SQL
• Python, PowerShell
• MITRE ATT&CK
• OAuth
• AWS, Azure, Google Cloud
• CI/CD

Location and Work Type

• Location: Illinois (hybrid)
• Posting type: Hyrbid/Remote

Compensation

• Salary: USD 130,000 - 195,000 per year
• Expected base salary range: $130,000 and $195,000
• Bonus: annual performance bonus
• Incentives: long-term incentives
• Base salary: competitive base salary

Preferred Qualifications

• Bachelor’s degree in Computer Science, Information Security, Data Science, Engineering, or a related discipline, or equivalent practical experience.
• Experience implementing or operating UEBA, EUBA, identity threat detection and response, non-human identity management, or identity security posture management capabilities.
• Experience with statistical analysis, machine learning, graph analytics, peer-group analysis, entity resolution, or AI-assisted security analytics.
• Experience detecting threats involving service accounts, machine identities, workload identities, OAuth applications, API keys, certificates, tokens, secrets, or autonomous agents.
• Working knowledge of identity and workload services in AWS, Azure, or Google Cloud.
• Experience with identity providers, privileged-access management, secrets-management, cloud identity, CI/CD, container, and workload orchestration technologies.
• Experience translating threat hunts, incident findings, or purple-team results into production detections and automated response workflows.
• Familiarity with MITRE ATT&CK and identity-focused threat frameworks, behavioral detection methodologies, and detection-as-code practices.
• Experience supporting governance, privacy, compliance, or audit requirements associated with identity and behavioral telemetry.

Additional Required Skills

• Access Management
• Application Security
• Endpoint Security
• Network Security
• Penetration Testing
• Security Architecture Design
• Security Information
• Security Information and Event Management (SIEM)
• Security Operations
• Vulnerability Management