Relativity is hiring a Senior Security Engineer to advance a layered, defense-in-depth security program with a focus on identity and endpoint security engineering. This hybrid role in Illinois combines technical ownership across EDR/XDR, identity security controls, telemetry and detection engineering, threat hunting, and security automation to support investigation and response at scale.
What you’ll do
- Deploy, integrate, optimize, and manage EDR/XDR platforms, including defining custom detections and automated response actions across security tooling.
- Own the implementation and enforcement of endpoint and image hardening baselines, configuration standards, and application control baselines.
- Integrate endpoint telemetry into central analytics/SIEM for security context and cross-domain correlation, and ensure SIEM coverage is adequate and effective.
- Act as a technical escalation point for endpoint-based events, exposures, vulnerabilities, and alerts, collaborating cross-functionally to drive remediation within applicable SLAs.
- Investigate complex endpoint alerts and incidents through root cause analysis, performing triage, forensic artifact collection (memory, disk, logs), timeline reconstruction, and containment/eradication actions.
- Design, deploy, integrate, and optimize identity security controls across workforce, privileged, service, and machine identities.
- Engineer and maintain identity capabilities including identity governance and administration, single sign-on, multi-factor authentication, conditional access, privileged access management, just-in-time access, secrets management, and identity threat detection and response.
- Design and enforce least-privilege access patterns using role-based and attribute-based access controls, segregation of duties, and lifecycle controls for joiner, mover, and leaver events.
- Integrate identity, authentication, authorization, and privileged-access telemetry into central analytics/SIEM to enable cross-domain correlation, detection, investigation, and automated response.
- Escalate and lead root-cause analysis for identity-based attacks and anomalous access, including credential compromise, privilege misuse, and authorization failures, then coordinate remediation.
- Automate identity and access provisioning, certification, policy enforcement, control validation, and response using APIs, scripting, workflow orchestration, and policy-as-code practices.
- Partner with IAM, IT, Security, Engineering, and application owners to embed secure identity patterns, remediate access risks, and improve adoption and usability of identity controls.
- Define and monitor identity-security measures such as authentication coverage, privileged-access reduction, access-review completion, policy compliance, identity-control health, detection efficacy, and remediation performance.
- Lead security control design across perimeter, network, host, application, identity, and data layers, ensuring control effectiveness at each layer.
- Serve as a subject matter expert for security control standards and design patterns aligned to industry-recognized frameworks.
- Validate that telemetry from each layer feeds central analytics for 360-degree visibility and appropriate attack surface coverage.
- Continuously assess enterprise security control effectiveness as the ecosystem and threat landscape evolve, proposing supplemental or extended coverage.
- Provide technically documented recommendations for control design decisions based on vulnerabilities, risks, issues, and events.
- Lead purple-team exercises and control-efficacy testing to validate depth and resilience under attack conditions, including structured threat hunting engagements in partnership with the Purple Team.
- Map structured hunts to MITRE ATT&CK and ATLAS techniques and current threat intelligence, then document hunt methodology, hypotheses, and outcomes.
- Convert hunt findings, exposure analysis, purple-team results, and alerts into durable automated detections and containment logic to improve coverage.
- Build and maintain SOAR workflows for enrichment, triage, containment, and routine response actions, and measure improvements in time-based detection and response.
- Identify and operationalize AI/ML capabilities for semantic anomaly detection, behavioral analytics, alert triage, and prioritization, supporting decisions on platform and tooling.
- Implement and manage data classification, discovery, and data security posture management across cloud and on-premises stores, including tuning DLP controls across multiple surfaces.
- Investigate data key risk indicators tied to data access and exfiltration and integrate data telemetry into central analytics/SIEM.
- Mentor junior and mid-level security engineers, serving as a day-to-day escalation point and supporting technical growth.
- Lead documentation and knowledge artifacts such as runbooks for assigned security initiatives.
- Participate in hiring processes including technical interviews and candidate assessments.
- Represent the security engineering team in cross-functional technical discussions, translating security requirements and findings for both engineering peers and non-technical stakeholders.
Requirements
- 4-8 years of hands-on enterprise security engineering experience with a focus on endpoints and identity.
- Hands-on experience with common security tools such as EDR, XDR, SIEM, CNAPP, CSPM, CWP, etc., and strong knowledge of security technologies across the OSI model.
- Demonstrated experience in threat hunting, digital forensics, and/or detection engineering, including automation scripts and security rules for enforcement and observability.
- Solid knowledge of industry frameworks and benchmarks such as MITRE and NIST.
- Demonstrated expertise in at least one automation/scripting language such as Python, Bash, or PowerShell applied to modern containerized services and CLI-based or security use cases.
- Demonstrated experience owning and driving complex security initiatives end-to-end, including cross-functional coordination, stakeholder communication, and delivery of technical outcomes.
- Ability to communicate technical findings clearly to both engineering peers and non-technical stakeholders.
- Relevant certification such as SSCP, Security+, or equivalent.
- Prior experience mentoring or providing technical guidance to junior engineers.
Technologies
EDR, XDR, SIEM, CNAPP, CSPM, CWP, OSI model, MITRE ATT&CK, ATLAS, SOAR, AI/ML, UEBA, ML-based alert prioritization, Python, Bash, PowerShell, AWS, Azure, GCP, SOC 2, ISO 27001, HIPAA, SSCP, Security+
Compensation and benefits
- Competitive base salary: $130,000 - $195,000 per year
- Annual performance bonus
- Long-term incentives
Preferred qualifications
- Bachelor’s in Computer Science, Information Security, or equivalent experience.
- Experience with AI-enabled SecOps (for example, UEBA, ML-based alert prioritization, or AI-assisted threat hunting workflows).
- Working knowledge of common cloud environments such as AWS, Azure, or GCP.
- Experience contributing endpoint or network security controls to CI/CD pipelines and infrastructure-as-code environments.
- Experience supporting compliance and audit requirements (SOC 2, ISO 27001, HIPAA) from a technical control perspective.
Required skills
- Access Management
- Application Security
- Endpoint Security
- Network Security
- Penetration Testing
- Security Architecture Design
- Security Information
- Security Information and Event Management (SIEM)
- Security Operations
- Vulnerability Management
