Senior Security Engineer - Identity & Endpoint

Relativity•Illinois, IL

4d•$130,000 - $195,000

About The Position

The Senior Security Engineer is a hands-on technical practitioner who advances Relativity’s enterprise security function through technical project leadership, cross-functional collaboration, and mentorship. The role owns complex security technology initiatives, including the design, deployment, and optimization of AI-enabled security technologies across a defense-in-depth program. It focuses on automating security operations and improving detection, response, and security hardening. The engineer serves as a technical escalation point and works closely with the Senior Manager of Enterprise Security and cross-functional engineering teams to reduce attack surface and improve detection and response across Relativity’s technical ecosystem. The position’s primary focus is identity and endpoint security engineering. It designs, deploys, and optimizes controls that protect workforce and privileged identities, devices, and enterprise access. The role strengthens identity governance, authentication, authorization, privileged access, endpoint hardening, device trust, threat detection, and response by integrating security technologies, automation, policy-based controls, and telemetry into the broader security operations ecosystem. The engineer also contributes to layered defense across perimeter, network, host, application, identity, and data layers; leads threat hunting and purple-team activities; builds SOAR workflows and operationalizes AI/ML security capabilities; and implements data classification, discovery, and loss-prevention controls. In addition, the role mentors security engineers, leads technical design and implementation, documents runbooks and knowledge artifacts, participates in hiring, and represents the security engineering team in cross-functional discussions.

Requirements

4–8 years of hands-on enterprise security engineering experience, focused on endpoints and identity.
Hands-on experience with common security tools such as EDR, XDR, SIEM, CNAPP, CSPM, and CWP, and strong knowledge of applicable security technologies across OSI layers.
Demonstrated experience in threat hunting, digital forensics, and/or detection engineering, including writing automation scripts and security enforcement or observability rules.
Solid knowledge of common industry security benchmarks and frameworks, such as MITRE and NIST.
Expertise in at least one scripting or automation language—Python, Bash, or PowerShell—applied to modern containerized services, CLI commands, and/or security use cases.
Experience owning and driving complex security initiatives end-to-end, including cross-functional coordination, stakeholder communication, and technical delivery.
Ability to clearly communicate technical findings to engineering peers and non-technical stakeholders.
Relevant certification such as SSCP, Security+, or equivalent.
Prior experience mentoring or providing technical guidance to junior engineers.

Nice To Haves

Bachelor’s degree in Computer Science, Information Security, or equivalent experience.
Experience with AI-enabled SecOps, such as UEBA detection, ML-based alert prioritization, or AI-assisted threat-hunting workflows.
Working knowledge of AWS, Azure, or GCP.
Experience contributing endpoint or network security controls to CI/CD pipelines and infrastructure-as-code environments.
Experience supporting SOC 2, ISO 27001, or HIPAA compliance and audit requirements from a technical-control perspective.

Responsibilities

Deploy, integrate, optimize, and manage EDR/XDR platforms; define custom detections and automated response actions.
Implement and enforce endpoint and image hardening baselines, configuration standards, and application-control baselines.
Integrate endpoint telemetry into SIEM or central analytics platforms and ensure coverage is adequate and effective.
Escalate endpoint security events, exposures, vulnerabilities, and alerts; coordinate remediation within appropriate SLAs.
Investigate complex endpoint alerts and incidents through root-cause analysis, triage, forensic artifact collection, timeline reconstruction, containment, and eradication.
Design, deploy, integrate, and optimize identity-security controls for workforce, privileged, service, and machine identities.
Engineer and maintain identity governance and administration, SSO, MFA, conditional access, PAM, just-in-time access, secrets management, and identity threat detection and response capabilities.
Design and enforce least-privilege access, role- and attribute-based access controls, segregation of duties, and joiner/mover/leaver lifecycle controls.
Integrate identity, authentication, authorization, and privileged-access telemetry into central analytics and SIEM platforms.
Respond to identity-based attacks, anomalous access, credential compromise, privilege misuse, and authorization failures through root-cause analysis and coordinated remediation.
Automate identity and access provisioning, certification, policy enforcement, control validation, and response using APIs, scripting, workflow orchestration, and policy-as-code.
Partner with IAM, IT, Security, Engineering, and application owners to embed secure identity patterns, remediate access risks, and improve adoption and usability of identity controls.
Define and monitor identity-security measures, including authentication coverage, privileged-access reduction, access-review completion, policy compliance, identity-control health, detection efficacy, and remediation performance.
Design, deploy, and optimize security controls across perimeter, network, host, application, identity, and data layers; maintain their effectiveness.
Contribute to and enforce security-control standards and design patterns aligned with industry-recognized frameworks, and provide subject-matter expertise during implementation and review.
Validate telemetry from each security layer feeds central analytics platforms and supports visibility and attack-surface coverage.
Assess enterprise security-control effectiveness as the ecosystem and threat landscape evolve; propose and implement supplemental coverage.
Partner with IT, Engineering, and other stakeholders to embed security controls and lead cross-functional initiatives.
Provide documented technical recommendations on security-control design in response to vulnerabilities, risks, issues, and events.
Lead purple-team exercises and control-efficacy testing; ensure complementary capabilities and redundancy across security layers.
Lead structured threat hunts and purple-team exercises with the Purple Team, analyze telemetry for anomalous or malicious behavior, and communicate findings.
Develop, execute, and document threat hunts mapped to MITRE ATT&CK and ATLAS techniques and current threat intelligence.
Analyze exposure related to vulnerabilities, zero-days, alert telemetry, threat intelligence, and partner or customer notifications; assess exploitability and risk.
Monitor evolving threats, adversary TTPs, and emerging vulnerabilities relevant to Relativity’s technical ecosystem.
Standardize and document hunt methodology, hypotheses, and outcomes, and mature the threat-hunting program with the Purple Team.
Convert threat hunts, exposure analysis, purple-team findings, and alerts into automated detections, containment logic, and improved coverage.
Build and maintain SOAR workflows to automate enrichment, triage, containment, and routine response actions; contribute to the automation roadmap.
Measure and improve automation’s impact on detection, containment, and response times to reduce threat-actor dwell time.
Evaluate and operationalize AI/ML capabilities for semantic anomaly detection, behavioral analytics, alert triage, and prioritization; recommend platform and tooling decisions.
Implement and manage data classification, discovery, and data security posture management across cloud and on-premises stores.
Deploy and tune data-loss-prevention controls across endpoint, network, email, cloud, and SaaS surfaces.
Investigate data-risk indicators related to access and exfiltration, and integrate data telemetry into SIEM.
Mentor junior and mid-level security engineers and provide day-to-day technical guidance and escalation support.
Lead technical design and implementation for assigned security initiatives and produce documentation, runbooks, and knowledge artifacts.
Participate in hiring, including technical interviews and candidate assessments.
Represent security engineering in cross-functional technical discussions and communicate security requirements and findings to technical and non-technical stakeholders.