Senior Security Engineer - Identity & Endpoint

Relativity is hiring a Senior Security Engineer to advance a layered, defense-in-depth security program with a focus on identity and endpoint security engineering. This hybrid role in Illinois combines technical ownership across EDR/XDR, identity security controls, telemetry and detection engineering, threat hunting, and security automation to support investigation and response at scale.

What you’ll do

• Deploy, integrate, optimize, and manage EDR/XDR platforms, including defining custom detections and automated response actions across security tooling.
• Own the implementation and enforcement of endpoint and image hardening baselines, configuration standards, and application control baselines.
• Integrate endpoint telemetry into central analytics/SIEM for security context and cross-domain correlation, and ensure SIEM coverage is adequate and effective.
• Act as a technical escalation point for endpoint-based events, exposures, vulnerabilities, and alerts, collaborating cross-functionally to drive remediation within applicable SLAs.
• Investigate complex endpoint alerts and incidents through root cause analysis, performing triage, forensic artifact collection (memory, disk, logs), timeline reconstruction, and containment/eradication actions.
• Design, deploy, integrate, and optimize identity security controls across workforce, privileged, service, and machine identities.
• Engineer and maintain identity capabilities including identity governance and administration, single sign-on, multi-factor authentication, conditional access, privileged access management, just-in-time access, secrets management, and identity threat detection and response.
• Design and enforce least-privilege access patterns using role-based and attribute-based access controls, segregation of duties, and lifecycle controls for joiner, mover, and leaver events.
• Integrate identity, authentication, authorization, and privileged-access telemetry into central analytics/SIEM to enable cross-domain correlation, detection, investigation, and automated response.
• Escalate and lead root-cause analysis for identity-based attacks and anomalous access, including credential compromise, privilege misuse, and authorization failures, then coordinate remediation.
• Automate identity and access provisioning, certification, policy enforcement, control validation, and response using APIs, scripting, workflow orchestration, and policy-as-code practices.
• Partner with IAM, IT, Security, Engineering, and application owners to embed secure identity patterns, remediate access risks, and improve adoption and usability of identity controls.
• Define and monitor identity-security measures such as authentication coverage, privileged-access reduction, access-review completion, policy compliance, identity-control health, detection efficacy, and remediation performance.
• Lead security control design across perimeter, network, host, application, identity, and data layers, ensuring control effectiveness at each layer.
• Serve as a subject matter expert for security control standards and design patterns aligned to industry-recognized frameworks.
• Validate that telemetry from each layer feeds central analytics for 360-degree visibility and appropriate attack surface coverage.
• Continuously assess enterprise security control effectiveness as the ecosystem and threat landscape evolve, proposing supplemental or extended coverage.
• Provide technically documented recommendations for control design decisions based on vulnerabilities, risks, issues, and events.
• Lead purple-team exercises and control-efficacy testing to validate depth and resilience under attack conditions, including structured threat hunting engagements in partnership with the Purple Team.
• Map structured hunts to MITRE ATT&CK and ATLAS techniques and current threat intelligence, then document hunt methodology, hypotheses, and outcomes.
• Convert hunt findings, exposure analysis, purple-team results, and alerts into durable automated detections and containment logic to improve coverage.
• Build and maintain SOAR workflows for enrichment, triage, containment, and routine response actions, and measure improvements in time-based detection and response.
• Identify and operationalize AI/ML capabilities for semantic anomaly detection, behavioral analytics, alert triage, and prioritization, supporting decisions on platform and tooling.
• Implement and manage data classification, discovery, and data security posture management across cloud and on-premises stores, including tuning DLP controls across multiple surfaces.
• Investigate data key risk indicators tied to data access and exfiltration and integrate data telemetry into central analytics/SIEM.
• Mentor junior and mid-level security engineers, serving as a day-to-day escalation point and supporting technical growth.
• Lead documentation and knowledge artifacts such as runbooks for assigned security initiatives.
• Participate in hiring processes including technical interviews and candidate assessments.
• Represent the security engineering team in cross-functional technical discussions, translating security requirements and findings for both engineering peers and non-technical stakeholders.

Requirements

• 4-8 years of hands-on enterprise security engineering experience with a focus on endpoints and identity.
• Hands-on experience with common security tools such as EDR, XDR, SIEM, CNAPP, CSPM, CWP, etc., and strong knowledge of security technologies across the OSI model.
• Demonstrated experience in threat hunting, digital forensics, and/or detection engineering, including automation scripts and security rules for enforcement and observability.
• Solid knowledge of industry frameworks and benchmarks such as MITRE and NIST.
• Demonstrated expertise in at least one automation/scripting language such as Python, Bash, or PowerShell applied to modern containerized services and CLI-based or security use cases.
• Demonstrated experience owning and driving complex security initiatives end-to-end, including cross-functional coordination, stakeholder communication, and delivery of technical outcomes.
• Ability to communicate technical findings clearly to both engineering peers and non-technical stakeholders.
• Relevant certification such as SSCP, Security+, or equivalent.
• Prior experience mentoring or providing technical guidance to junior engineers.

Technologies

EDR, XDR, SIEM, CNAPP, CSPM, CWP, OSI model, MITRE ATT&CK, ATLAS, SOAR, AI/ML, UEBA, ML-based alert prioritization, Python, Bash, PowerShell, AWS, Azure, GCP, SOC 2, ISO 27001, HIPAA, SSCP, Security+

Compensation and benefits

• Competitive base salary: $130,000 - $195,000 per year
• Annual performance bonus
• Long-term incentives

Preferred qualifications

• Bachelor’s in Computer Science, Information Security, or equivalent experience.
• Experience with AI-enabled SecOps (for example, UEBA, ML-based alert prioritization, or AI-assisted threat hunting workflows).
• Working knowledge of common cloud environments such as AWS, Azure, or GCP.
• Experience contributing endpoint or network security controls to CI/CD pipelines and infrastructure-as-code environments.
• Experience supporting compliance and audit requirements (SOC 2, ISO 27001, HIPAA) from a technical control perspective.

Required skills

• Access Management
• Application Security
• Endpoint Security
• Network Security
• Penetration Testing
• Security Architecture Design
• Security Information
• Security Information and Event Management (SIEM)
• Security Operations
• Vulnerability Management