Senior Security Engineer - Network Security

Relativity is hiring a Senior Security Engineer - Network Security for a hybrid role in Illinois.

Responsibilities

• Lead the design, deployment, configuration, and optimization of network security controls across on-premises, cloud, and hybrid environments.
• Engineer and maintain security capabilities including firewalls, network detection and response, secure web gateways, DNS security, SASE/SSE, VPN or ZTNA, adaptive access policies, and cloud-native network security controls.
• Design and validate network segmentation and access-control patterns to reduce attack paths and limit lateral movement.
• Integrate network telemetry (flow, DNS, proxy, firewall, and packet-derived data) into SIEM, analytics, and automated response workflows.
• Develop detections and lead investigations for command-and-control, lateral movement, anomalous traffic, unauthorized access, and data exfiltration.
• Automate network security configuration, validation, and response using APIs, scripting, infrastructure as code, and policy-as-code.
• Partner with Infrastructure, Cloud, and Engineering teams to support secure connectivity, architecture reviews, control implementation, and remediation.
• Define and monitor measures such as control coverage, telemetry health, segmentation effectiveness, detection efficacy, and remediation performance.
• Lead security controls across perimeter, network, host, application, identity, and data layers, ensuring effectiveness at each layer.
• Contribute to and enforce security control standards and design patterns aligned to industry frameworks; serve as an SME during implementation and review.
• Validate telemetry from each layer supports centralized analytics for 360-degree visibility and appropriate attack surface coverage.
• Continuously assess enterprise control effectiveness as the ecosystem expands and threats evolve; propose and implement extended coverage.
• Act as a technical lead to embed security controls natively through cross-functional initiatives.
• Provide technical recommendations tied to vulnerabilities, risks, issues, and events; support lead-level decisions with well-documented analysis.
• Lead purple-team exercises and control-efficacy testing to verify depth and resilience under attack conditions.
• Run structured threat hunting engagements with the Purple Team, analyzing telemetry to identify anomalous and malicious behavior and report findings to stakeholders.
• Develop, execute, and document hunts mapped to MITRE ATT&CK and ATLAS techniques and current threat intelligence.
• Perform exposure analysis using vulnerabilities, zero-day information, alert telemetry, threat intelligence feeds, and partner/customer notifications to determine exploitability and exposure risk.
• Standardize and document hunt methodology, hypotheses, and outcomes to mature the threat hunting program.
• Convert successful hunts, exposure analysis, purple-team findings, and alerts into durable automated detections and containment logic.
• Build and maintain SOAR workflows to automate enrichment, triage, containment, and routine response actions; support the automation roadmap.
• Measure and improve automation impact to reduce time-based detection, containment, and response to minimize threat actor dwell time.
• Identify and operationalize AI/ML capabilities for semantic anomaly detection, behavioral analytics, alert triage, and prioritization; recommend tooling and platform decisions.
• Implement and manage data classification, discovery, and data security posture management across cloud and on-premises stores.
• Deploy and tune data loss prevention (DLP) controls across endpoints, network, email, cloud, and SaaS surfaces.
• Investigate data key risk indicators related to data access and exfiltration, and integrate related data telemetry into SIEM.
• Serve as a technical mentor and day-to-day escalation point for junior and mid-level security engineers.
• Lead technical design and implementation for assigned security initiatives; produce documentation, runbooks, and knowledge artifacts.
• Participate in hiring processes including technical interviews and candidate assessments.
• Represent security engineering in cross-functional technical discussions, translating security requirements and findings for engineering and non-technical stakeholders.

Requirements

• 4-8 years of hands-on experience in enterprise security engineering with a focus on network security.
• Hands-on experience with common security tools such as EDR, XDR, SIEM, CNAPP, CSPM, CWP, and strong knowledge of security technologies across OSI layers.
• Demonstrated experience in threat hunting, digital forensics, and/or detection engineering, including writing automation scripts and rules for security enforcement and observability.
• Solid knowledge of industry-standard security benchmarks and frameworks (e.g., MITRE, NIST).
• Demonstrated expertise in at least one automation/scripting language: Python, Bash, or PowerShell, applied to containerized services, CLI commands, and/or security use cases.
• Demonstrated experience owning and driving complex security initiatives end-to-end, including cross-functional coordination, stakeholder communication, and delivery.
• Ability to communicate technical findings clearly to both engineering peers and non-technical stakeholders.
• Relevant certification such as Network+, CCSA, ITS-NS, CCT, FCF, PCCET, or equivalent.
• Prior experience mentoring or providing technical guidance to junior engineers.

Technologies

• AI/ML, SOAR
• Python, Bash, PowerShell
• EDR, XDR, SIEM
• CNAPP, CSPM, CWP
• MITRE ATT&CK, ATLAS
• SASE/SSE, VPN, ZTNA
• Infrastructure as code, policy-as-code
• DNS security, firewalls, secure web gateways

Benefits

• Total compensation includes competitive base salary, an annual performance bonus, and long-term incentives.

Preferred Qualifications

• Bachelor’s in Computer Science, Information Security, or equivalent experience.
• Experience with AI-enabled SecOps (e.g., UEBA, ML-based alert prioritization, or AI-assisted threat hunting workflows).
• Working knowledge of AWS, Azure, or GCP.
• Experience contributing endpoint or network security controls to CI/CD pipelines and infrastructure-as-code environments.
• Experience supporting compliance and audit requirements from a technical control perspective (SOC 2, ISO 27001, HIPAA).

Required Skills

• Access Management
• Application Security
• Endpoint Security
• Network Security
• Penetration Testing
• Security Architecture Design
• Security Information
• Security Information and Event Management (SIEM)
• Security Operations
• Vulnerability Management

Location: Illinois (hybrid)

Compensation: USD 130,000 - 195,000 per year

Minimum Experience: 4 years