Senior Security Engineer - Network Security

Relativity’s Network Security team builds and strengthens security controls across on-premises, cloud, and hybrid environments. In this role, you will help design, deploy, and optimize layered network defenses, improve threat detection through SIEM and automated response workflows, and lead structured threat hunting and control-efficacy testing. You will also mentor engineers and contribute to a security engineering culture focused on measurable coverage, resilient controls, and continuous improvement.

Responsibilities

• Lead the design, deployment, configuration, and optimization of network security controls across on-premises, cloud, and hybrid environments.
• Engineer and maintain capabilities including firewalls, network detection and response, secure web gateways, DNS security, SASE/SSE, VPN or ZTNA, adaptive access policies, and cloud-native network security controls.
• Design and validate network segmentation and access-control patterns to reduce attack paths and limit lateral movement.
• Integrate network telemetry (flow, DNS, proxy, firewall, and packet-derived data) into SIEM, analytics, and automated response workflows.
• Develop detections and investigate command-and-control activity, lateral movement, anomalous traffic, unauthorized access, and data exfiltration.
• Automate security configuration, validation, and response using APIs, scripting, infrastructure as code, and policy-as-code practices.
• Partner with Infrastructure, Cloud, and Engineering teams on secure connectivity, architecture reviews, control implementation, and remediation.
• Define and monitor network-security measures including control coverage, telemetry health, segmentation effectiveness, detection efficacy, and remediation performance.
• Lead security control design spanning perimeter, network, host, application, identity, and data layers, ensuring effectiveness across each layer.
• Serve as a subject matter expert to enforce security control standards and design patterns aligned to industry-recognized frameworks.
• Validate that telemetry from each layer supports 360-degree visibility and appropriate attack-surface coverage in central analytics platforms.
• Continuously assess enterprise control effectiveness as the ecosystem expands and threats evolve, proposing and implementing supplemental coverage.
• Lead purple-team exercises and control-efficacy testing to verify depth and resilience under attack conditions.
• Develop and execute structured threat hunts mapped to MITRE ATT&CK and ATLAS techniques and current threat intelligence.
• Perform exposure analysis on vulnerabilities, zero-day findings, alert telemetry, threat intelligence feeds, and partner/customer notifications to assess exploitability risk.
• Standardize and document hunt methodology, hypotheses, and outcomes to mature the threat hunting program in partnership with the Purple Team.
• Convert hunt results, exposure analysis, purple-team findings, and alerts into durable automated detections and containment logic.
• Build and maintain SOAR workflows to automate enrichment, triage, containment, and routine response actions, improving time to detect and respond.
• Identify, evaluate, and operationalize AI/ML capabilities for semantic anomaly detection, behavioral analytics, alert triage, and prioritization.
• Implement and manage data classification, discovery, and data security posture management across cloud and on-premises stores.
• Deploy and tune data loss prevention controls across endpoints, network, email, cloud, and SaaS surfaces.
• Investigate data key risk indicators tied to data access and exfiltration and integrate relevant telemetry into central analytics (SIEM).
• Act as a technical mentor and day-to-day escalation point for junior and mid-level security engineers, guiding technical approach and development.
• Lead technical design and implementation for assigned security initiatives, producing documentation, runbooks, and knowledge artifacts.
• Participate in hiring processes including technical interviews and candidate assessments.
• Represent security engineering in cross-functional technical discussions, clearly translating security requirements and findings.

Requirements

• 4-8 years of hands-on experience in enterprise security engineering, with a focus on network security.
• Hands-on experience with common security tools such as EDR, XDR, SIEM, CNAPP, CSPM, CWP, and strong knowledge of security technologies across all layers of the OSI model.
• Demonstrated experience in threat hunting, digital forensics, and/or detection engineering, including writing automation scripts and rules for security enforcement and observability.
• Solid knowledge of industry-standard common security benchmarks and frameworks (e.g., MITRE, NIST, etc.).
• Demonstrated expertise in at least one scripting/automation language (Python, Bash, or PowerShell) applied to modern containerized services, CLI-based commands, and/or security use cases.
• Demonstrated experience owning and driving complex security initiatives end-to-end, including cross-functional coordination, stakeholder communication, and delivery of technical outcomes.
• Ability to communicate technical findings clearly to both engineering peers and non-technical stakeholders.
• Relevant certification such as Network+, CCSA, ITS-NS, CCT, FCF, PCCET, or equivalent.
• Prior experience mentoring or providing technical guidance to junior engineers.

Technologies

• AI/ML, SOAR, Python, Bash, PowerShell
• EDR, XDR, SIEM, CNAPP, CSPM, CWP
• MITRE ATT&CK, ATLAS, SASE/SSE, VPN, ZTNA
• Infrastructure as code, policy-as-code, DNS security, firewalls, secure web gateways

Benefits

• Total compensation eligibility includes a competitive base salary, an annual performance bonus, and long-term incentives.

Additional Preferred Qualifications

• Bachelor’s in Computer Science, Information Security, or equivalent experience.
• Experience with AI-enabled SecOps (e.g., UEBA, ML-based alert prioritization, or AI-assisted threat hunting workflows).
• Working knowledge of common cloud environments such as AWS, Azure, or GCP.
• Experience contributing endpoint or network security controls to CI/CD pipelines and infrastructure-as-code environments.
• Experience supporting compliance and audit requirements (SOC 2, ISO 27001, HIPAA) from a technical control perspective.

Required Skills

• Access Management, Application Security, Endpoint Security, Network Security
• Penetration Testing, Security Architecture Design
• Security Information, SIEM
• Security Operations, Vulnerability Management

Location: Illinois (hybrid). Compensation: USD 130,000 - 195,000 per year. Experience: 4+ years.