Senior Security Engineer - Identity & Endpoint

Relativity is hiring a Senior Security Engineer to strengthen identity and endpoint security engineering within a layered defense-in-depth program. This role helps lead technical initiatives across security detections, hardening, telemetry, threat hunting, and automated response, with an emphasis on turning findings into durable controls.

Based in Illinois in a hybrid setup, the position supports security engineering across workforce, privileged, service, and machine identities, while also owning endpoint and data security capabilities that feed central analytics and SIEM for cross-domain visibility.

Responsibilities

• Deploy, integrate, optimize, and manage EDR/XDR platforms; define custom detections and automated response actions across security tooling.
• Own the implementation and enforcement of endpoint and image hardening baselines, configuration standards, and application control baselines.
• Integrate endpoint telemetry into the central analytics platform or SIEM to provide security context and cross-domain correlation; ensure SIEM coverage is adequate and effective.
• Act as a technical escalation point for endpoint-based security events, exposures, vulnerabilities, and alerts; collaborate cross-functionally to drive remediation within appropriate SLAs.
• Investigate complex endpoint alerts and incidents end-to-end, including triage, forensic artifact collection (memory, disk, logs), timeline reconstruction, and containment and eradication actions.
• Design, deploy, integrate, and optimize identity security controls across workforce, privileged, service, and machine identities.
• Engineer and maintain identity capabilities including identity governance and administration, single sign-on, multi-factor authentication, conditional access, privileged access management, just-in-time access, secrets management, and identity threat detection and response.
• Design and enforce least-privilege access patterns with role-based and attribute-based access controls, segregation of duties, and lifecycle controls for joiner, mover, and leaver events.
• Integrate identity, authentication, authorization, and privileged-access telemetry into central analytics and SIEM to enable cross-domain correlation, detection, investigation, and automated response.
• Escalate and lead root-cause analysis for identity-based attacks, anomalous access, credential compromise, privilege misuse, and authorization failures, coordinating remediation.
• Automate identity and access provisioning, certification, policy enforcement, control validation, and response through APIs, scripting, workflow orchestration, and policy-as-code practices.
• Partner with IAM, IT, Security, Engineering, and application owners to embed secure identity patterns, remediate access risks, and improve adoption and usability of identity controls.
• Define and monitor identity-security measures including authentication coverage, privileged-access reduction, access-review completion, policy compliance, identity-control health, detection efficacy, and remediation performance.
• Lead security-control design, deployment, and optimization across perimeter, network, host, application, identity, and data layers, maintaining effectiveness across each layer.
• Contribute to and enforce security control standards and design patterns aligned to industry-recognized frameworks, serving as a subject matter expert during implementation and review.
• Validate that telemetry from each layer feeds central analytics and supports 360-degree visibility and appropriate attack surface coverage.
• Continuously assess enterprise security control effectiveness as the ecosystem expands and the threat landscape evolves, proposing and implementing extended coverage.
• Provide technical recommendations on security control design aligned to vulnerabilities, risks, issues, and events, supporting lead-level decisions with well-documented analysis.
• Lead purple-team exercises and control-efficacy testing to verify depth and resilience under attack conditions.
• Ensure redundant, complementary capabilities to prevent bypasses and maintain failure redundancy across security layers.
• Lead structured threat hunting engagements and purple-team exercises in partnership with the Purple Team, analyzing telemetry to surface anomalous or malicious behavior and communicating findings.
• Develop, execute, and document structured hunts mapped to MITRE ATT&CK and ATLAS techniques and current threat intelligence.
• Perform exposure analysis for vulnerabilities, zero-day risks, alert telemetry, threat intelligence feeds, and partner or customer notifications to conclude on exploitability risk and exposure.
• Maintain awareness of the evolving threat landscape, adversary TTPs, and emerging vulnerabilities relevant to Relativity’s ecosystem.
• Standardize and document threat-hunting methodology, hypotheses, and outcomes to mature the program with the Purple Team.
• Convert successful hunts, exposure analysis, purple-team findings, and alerts into durable, automated detections and containment logic to improve coverage.
• Build and maintain SOAR workflows that automate enrichment, triage, containment, and routine response actions, contributing to a broader automation roadmap.
• Measure and improve automation impact on time-based detection, containment, and response to reduce threat actor dwell time.
• Identify, evaluate, and operationalize AI/ML capabilities for semantic anomaly detection, behavioral analytics, alert triage, and prioritization; recommend platform and tooling decisions.
• Implement and manage data classification, discovery, and data security posture management across cloud and on-premises stores.
• Deploy and tune data loss prevention controls across endpoints, network, email, cloud, and SaaS surfaces.
• Investigate data key risk indicators tied to data access and exfiltration, and integrate data telemetry into central analytics (SIEM).
• Serve as a technical mentor and day-to-day escalation point for junior and mid-level security engineers, guiding technical approach, tooling, and professional development.
• Lead technical design and implementation efforts for assigned initiatives, producing clear documentation, runbooks, and knowledge artifacts.
• Participate in hiring processes including technical interviews and candidate assessments.
• Represent the security engineering team in cross-functional technical discussions, translating security requirements and findings clearly for both engineering peers and non-technical stakeholders.

Requirements

• 4-8 years of hands-on enterprise security engineering experience, with focus on endpoints and identity.
• Hands-on experience with security tools such as EDR, XDR, SIEM, CNAPP, CSPM, CWP and strong knowledge of applicable security technologies across the OSI model.
• Demonstrated experience in threat hunting, digital forensics, and/or detection engineering, including writing automation scripts and rules for security enforcement and observability.
• Solid knowledge of industry standard benchmarks and frameworks (for example, MITRE and NIST).
• Demonstrated expertise in at least one scripting or automation language such as Python, Bash, or PowerShell, applied to modern containerized services, CLI use, and/or security use cases.
• Demonstrated experience owning and driving complex security initiatives end-to-end, including cross-functional coordination, stakeholder communication, and delivery of technical outcomes.
• Ability to communicate technical findings clearly to both engineering peers and non-technical stakeholders.
• Relevant certification such as SSCP, Security+ or equivalent.
• Prior experience mentoring or providing technical guidance to junior engineers.

Technologies

• EDR, XDR, SIEM, CNAPP, CSPM, CWP
• OSI model
• MITRE ATT&CK, ATLAS
• SOAR, AI/ML, UEBA, ML-based alert prioritization
• Python, Bash, PowerShell
• AWS, Azure, GCP
• SOC 2, ISO 27001, HIPAA
• SSCP, Security+

Benefits

• Competitive base salary
• Annual performance bonus
• Long-term incentives

Compensation: USD 130,000 - 195,000 per year. Location: Illinois (hybrid). Minimum experience: 4 years.

Preferred Qualifications

• Bachelor’s in Computer Science, Information Security, or equivalent experience.
• Experience with AI-enabled SecOps (for example: UEBA, ML-based alert prioritization, or AI-assisted threat hunting workflows).
• Working knowledge of cloud environments such as AWS, Azure, or GCP.
• Experience contributing endpoint or network security controls to CI/CD pipelines and infrastructure-as-code environments.
• Experience supporting compliance and audit requirements (SOC 2, ISO 27001, HIPAA) from a technical control perspective.

Required Skills

• Access Management
• Application Security
• Endpoint Security
• Network Security
• Penetration Testing
• Security Architecture Design
• Security Information
• Security Information and Event Management (SIEM)
• Security Operations
• Vulnerability Management