Security Engineer

Relativity•Illinois, IL

5d•$90,000 - $134,000•Hybrid

About The Position

The Security Engineer implements, operates, and continuously improves enterprise security capabilities across endpoint, network, identity, cloud, and data security domains. Working within Relativity’s defense-in-depth program, the engineer independently executes security engineering initiatives, investigates security events and exposures, develops security automation, and partners with cross-functional teams to improve visibility, resilience, and operational effectiveness. The role contributes to detection and response, security hardening, threat hunting, and exposure reduction while developing broader expertise across the enterprise security ecosystem. Work includes implementing and validating layered security controls; administering endpoint protection and hardening; investigating alerts and incidents; developing detections and SOAR automation; supporting data security and vulnerability management; and helping operationalize AI/ML capabilities for security operations.

Requirements

Familiarity with enterprise security concepts across network, endpoint, identity, cloud, and data security domains.
Basic knowledge of industry-standard security benchmarks and frameworks, such as MITRE and NIST.
Proficiency in at least one scripting or automation language—Python, Bash, or PowerShell—applied to modern containerized services, CLI commands, or security use cases.
Experience investigating security alerts, incidents, or suspicious activity.
Ability to communicate technical findings clearly to engineering peers and non-technical stakeholders.

Nice To Haves

Bachelor’s degree in Computer Science or Information Security, equivalent experience, or security certifications such as CompTIA Security+, CompTIA Network+, or ISC2 SSCP.
Basic knowledge of cloud environments such as AWS, Azure, or GCP.
Hands-on enterprise security engineering experience focused on detection and response, red teaming, or ethical hacking.
Hands-on experience with tools such as EDR, XDR, SIEM, CNAPP, CSPM, or CWP, and intermediate knowledge of security technologies across OSI layers.
Exposure to threat modeling, threat hunting, digital forensics, or detection engineering, including writing automation scripts and security enforcement or observability rules.
Familiarity with AI-enabled SecOps, such as UEBA, ML-based alert prioritization, or AI-assisted threat hunting workflows.
Working knowledge of software development lifecycle, software engineering practices, or infrastructure-as-code environments.
Experience supporting compliance and audit requirements such as SOC 2, ISO 27001, or HIPAA from a technical control perspective.

Responsibilities

Implement, configure, maintain, and assess security controls across perimeter, network, host, application, identity, and data layers.
Collaborate across teams to deploy controls in alignment with recognized frameworks and validate that telemetry supports comprehensive visibility and attack surface coverage.
Monitor control effectiveness, identify gaps, support remediation, and recommend security tools, configurations, and operational improvements.
Participate in security assessments, control validation exercises, and purple-team activities.
Deploy, configure, and administer EDR/XDR platforms and maintain endpoint, image-hardening, configuration, and application-control baselines.
Monitor endpoint telemetry and validate its integration and coverage in central analytics or SIEM platforms.
Investigate endpoint alerts and incidents through root-cause analysis, including triage, forensic artifact collection, timeline reconstruction, containment, and eradication.
Analyze security telemetry and conduct structured threat hunts mapped to MITRE ATT&CK and ATLAS and current threat intelligence.
Document hunt hypotheses, outcomes, and recommendations; investigate vulnerabilities, zero-days, alerts, and threat intelligence to assess exploitability and exposure.
Develop and tune detection rules, correlation logic, and alerting use cases; turn hunt and assessment findings into durable detections and containment logic.
Build and maintain SOAR workflows and playbooks to automate enrichment, triage, containment, and routine response actions.
Develop scripts and tooling using supported languages such as Python, PowerShell, or Bash, and improve automation’s effect on detection, containment, and response times.
Assist in evaluating and operationalizing AI/ML capabilities for anomaly detection, behavioral analytics, alert triage, and prioritization.
Support deployment and operation of data classification, discovery, and data security posture management across cloud and on-premises stores.
Deploy and tune data loss prevention controls across endpoint, network, email, cloud, and SaaS surfaces; integrate related telemetry into centralized monitoring.
Monitor data security alerts and investigate potential data protection concerns and indicators of risky access or exfiltration.
Support vulnerability and exposure management through validation, prioritization, remediation, attack-surface analysis, and verification of compensating controls.
Maintain awareness of emerging threats, adversary techniques, and vulnerabilities relevant to Relativity’s technical environment.