Senior Security Engineer

Relativity is hiring a Senior Security Engineer in Illinois (hybrid) to strengthen security operations with entity and user behavior analytics (EUBA) and non-human identity behavior analytics (NHIBA). In this role, you will design and operationalize behavioral detections, connect identity and telemetry sources, and help automate investigation and response for both human and non-human identities.

Responsibilities

• Design, deploy, integrate, and optimize platforms and capabilities supporting Entity and User Behavior Analytics and Non-Human Identity Behavior Analytics.
• Aggregate and normalize telemetry from identity providers, endpoints, applications, cloud platforms, APIs, privileged-access systems, service accounts, secrets platforms, and automated workloads.
• Develop and maintain behavioral baselines for workforce users, privileged identities, service accounts, machine identities, applications, agents, and other automated entities.
• Engineer analytics to identify anomalous access, credential misuse, privilege escalation, unusual resource interaction, abnormal execution patterns, lateral movement, and deviations from expected identity behavior.
• Build behavioral risk models that combine identity sensitivity, privilege, asset context, access patterns, threat intelligence, and observed activity.
• Evaluate detection performance across precision, false-positive rates, behavioral model drift, telemetry quality, and coverage gaps, then continuously tune analytics for operational value.
• Integrate behavioral findings into SIEM, XDR, SOAR, identity threat detection and response, and case-management workflows.
• Act as a technical escalation point for complex behavioral anomalies involving human and non-human identities.
• Lead behavioral detection design and optimization across workforce, privileged, service, machine, application, workload, and agent identities.
• Establish methods to discover, classify, inventory, and monitor non-human identities across cloud, SaaS, on-premises, development, and automation environments.
• Analyze authentication, authorization, privilege use, credential activity, token use, secrets access, API behavior, workload communication, and resource-interaction patterns.
• Develop detections for dormant or abandoned identities, shared credentials, unexpected privilege use, credential rotation failures, unauthorized token activity, anomalous service-account behavior, and deviations from an identity’s intended purpose.
• Correlate identity behavior with ownership, business purpose, privilege level, application dependencies, data sensitivity, asset exposure, and lifecycle status.
• Partner with IAM, PAM, IT, Engineering, application owners, and platform teams to improve telemetry, identity attribution, ownership data, and remediation workflows.
• Automate investigation, enrichment, risk scoring, containment, credential rotation, access restriction, and escalation workflows for high-confidence anomalies.
• Define and monitor measures such as identity coverage, attributable ownership, behavioral-baseline coverage, detection precision, anomaly investigation time, remediation performance, and reduction in unmanaged or high-risk non-human identities.
• Correlate identity, endpoint, network, application, cloud, data, and access telemetry to detect activity that can look legitimate in isolation but becomes suspicious across the environment.
• Design behavioral detections that account for entity relationships, privilege, asset sensitivity, historical activity, peer-group behavior, and expected business use.
• Validate that telemetry is sufficiently complete, timely, contextualized, and attributable to support reliable behavioral analytics.
• Identify visibility gaps that hinder effective monitoring of human or non-human identities and drive cross-functional improvements in telemetry and context.
• Translate threat intelligence, incident findings, purple-team results, and emerging attack techniques into new behavioral hypotheses and analytics.
• Conduct control-efficacy testing to validate detections for identity misuse, credential compromise, privilege abuse, lateral movement, and automated workload anomalies.
• Provide technical recommendations on telemetry architecture, analytics platforms, behavioral models, and response controls.
• Ensure behavioral analytics complement preventive controls and add coverage when individual controls are bypassed or fail.
• Lead hypothesis-driven threat hunts focused on anomalous human and non-human identity behavior, including credential misuse, privilege abuse, token theft, lateral movement, service-account compromise, and malicious automation.
• Develop and document hunts mapped to MITRE ATT&CK, relevant identity attack techniques, current threat intelligence, and observed behavioral patterns.
• Establish peer groups and expected behavioral patterns to distinguish legitimate operational variance from suspicious activity.
• Investigate behavioral outliers using root-cause analysis, timeline reconstruction, entity relationship mapping, and validation with identity or application owners.
• Standardize hunt hypotheses, data requirements, analysis methods, findings, and outcomes.
• Convert successful hunts, incidents, purple-team findings, and emerging attack patterns into durable analytics, risk models, and automated response logic.
• Build and maintain automated workflows to enrich behavioral anomalies with identity, asset, privilege, ownership, application, threat-intelligence, and historical activity context.
• Automate triage, risk scoring, case creation, stakeholder validation, containment, credential rotation, access restriction, and escalation for behavioral detections.
• Evaluate and operationalize statistical, machine-learning, graph, peer-group, and AI-assisted techniques for anomaly detection and behavioral analysis.
• Define validation methods for analytics and models, including precision, recall, false-positive rate, detection latency, coverage, model drift, and analyst feedback.
• Apply explainability and supporting evidence so behavioral findings can be understood, investigated, and acted on by security analysts and system owners.
• Establish safeguards, monitoring, and human-review requirements for automated investigation or response actions.
• Measure and continuously improve impact on detection time, investigation time, containment time, analyst effort, and threat-actor dwell time.
• Mentor junior and mid-level security engineers, providing guidance on technical approach, tooling, and professional development.
• Lead technical design and implementation of behavioral analytics, identity detection, telemetry integration, and automated response initiatives, producing architecture documentation, detection specifications, runbooks, and knowledge artifacts.
• Participate in hiring processes, including technical interviews and candidate assessments.
• Represent the security engineering team in cross-functional technical discussions, translating security requirements and findings for engineering peers and non-technical stakeholders.

Requirements

• 4–8 years of hands-on experience in security engineering, detection engineering, identity security, threat hunting, security analytics, or a related discipline.
• Experience developing behavioral analytics, anomaly detections, correlation logic, threat-hunting queries, or risk-scoring methods from security telemetry.
• Experience analyzing activity for workforce identities, privileged accounts, service accounts, machine identities, applications, APIs, or cloud workloads.
• Hands-on experience with SIEM, XDR, UEBA/EUBA, identity threat detection and response, SOAR, or comparable security analytics platforms.
• Strong understanding of authentication, authorization, privilege, credentials, tokens, secrets, service accounts, workload identities, and common identity-based attack techniques.
• Experience integrating and analyzing telemetry from identity providers, endpoints, cloud platforms, applications, privileged-access systems, and other enterprise security technologies.
• Proficiency in at least one query, scripting, or programming language: KQL, SPL, SQL, Python, PowerShell, or equivalent.
• Experience measuring and tuning detection efficacy, including false-positive reduction, coverage analysis, validation, and operationalization of findings.
• Demonstrated experience leading complex security initiatives through design, implementation, testing, stakeholder coordination, and operational adoption.
• Ability to communicate analytical findings, behavioral risk, and technical recommendations to engineering teams, system owners, security analysts, and non-technical stakeholders.
• Relevant certifications in security analytics, cloud security, identity security, incident response, or security engineering such as CySA+, SSCP, Security+, or equivalent.
• Prior experience mentoring or providing technical guidance to junior engineers.

Technologies

• SIEM, XDR, SOAR, UEBA/EUBA
• KQL, SPL, SQL, Python, PowerShell
• MITRE ATT&CK, OAuth
• AWS, Azure, Google Cloud
• CI/CD

Compensation and Benefits

• Annual base salary: USD 130,000 - 195,000
• Annual performance bonus
• Long-term incentives

Preferred Qualifications

• Bachelor’s degree in Computer Science, Information Security, Data Science, Engineering, or a related discipline, or equivalent practical experience.
• Experience implementing or operating UEBA, EUBA, identity threat detection and response, non-human identity management, or identity security posture management capabilities.
• Experience with statistical analysis, machine learning, graph analytics, peer-group analysis, entity resolution, or AI-assisted security analytics.
• Experience detecting threats involving service accounts, machine identities, workload identities, OAuth applications, API keys, certificates, tokens, secrets, or autonomous agents.
• Working knowledge of identity and workload services in AWS, Azure, or Google Cloud.
• Experience with identity providers, privileged-access management, secrets-management, cloud identity, CI/CD, container, and workload orchestration technologies.
• Experience translating threat hunts, incident findings, or purple-team results into production detections and automated response workflows.
• Familiarity with MITRE ATT&CK and identity-focused threat frameworks, behavioral detection methodologies, and detection-as-code practices.
• Experience supporting governance, privacy, compliance, or audit requirements associated with identity and behavioral telemetry.