Senior Security Engineer - EUBA & NHIBA

Relativity•Illinois, IL

7d•$130,000 - $195,000

About The Position

The Senior Security Engineer is a hands-on technical practitioner who advances the enterprise security function through behavioral analytics, detection engineering, technical project leadership, cross-functional collaboration, and mentorship. The role owns complex initiatives combining identity, endpoint, application, cloud, and access telemetry to identify anomalous activity involving human and non-human identities, and serves as a technical escalation point for the security engineering team. The primary focus is Entity and User Behavior Analytics (EUBA) and Non-Human Identity Behavior Analytics (NHIBA). The engineer designs, deploys, and optimizes capabilities to detect anomalous and high-risk activity across workforce users, privileged accounts, service accounts, machine identities, applications, and automated workloads. The role integrates telemetry, establishes behavioral baselines, develops risk-based detections, and automates investigation and response. The position also leads threat hunting and cross-domain behavioral detection, operationalizes analytics and automation, evaluates statistical, machine-learning, graph, peer-group, and AI-assisted techniques, and mentors security engineers. Relativity describes the compensation as a competitive base salary, annual performance bonus, and long-term incentives. The expected salary range is $130,000 to $195,000; final compensation depends on factors including experience, skills, qualifications, and internal pay equity.

Requirements

4–8 years of hands-on experience in security engineering, detection engineering, identity security, threat hunting, security analytics, or a related discipline.
Demonstrated experience developing behavioral analytics, anomaly detections, correlation logic, threat-hunting queries, or risk-scoring methods from security telemetry.
Experience analyzing activity associated with workforce identities, privileged accounts, service accounts, machine identities, applications, APIs, or cloud workloads.
Hands-on experience with SIEM, XDR, UEBA/EUBA, identity threat detection and response, SOAR, or comparable security analytics platforms.
Strong understanding of authentication, authorization, privilege, credentials, tokens, secrets, service accounts, workload identities, and common identity-based attack techniques.
Experience integrating and analyzing telemetry from identity providers, endpoints, cloud platforms, applications, privileged-access systems, and other enterprise security technologies.
Proficiency in at least one query, scripting, or programming language such as KQL, SPL, SQL, Python, PowerShell, or equivalent.
Experience measuring and tuning detection efficacy, including false-positive reduction, coverage analysis, validation, and operationalization of findings.
Demonstrated experience leading complex security initiatives through design, implementation, testing, stakeholder coordination, and operational adoption.
Ability to communicate analytical findings, behavioral risk, and technical recommendations to engineering teams, system owners, security analysts, and non-technical stakeholders.
Relevant certifications in security analytics, cloud security, identity security, incident response, or security engineering, such as CySA+, SSCP, Security+, or equivalent.
Prior experience mentoring or providing technical guidance to junior engineers.

Nice To Haves

Bachelor’s degree in Computer Science, Information Security, Data Science, Engineering, or a related discipline, or equivalent practical experience.
Experience implementing or operating UEBA, EUBA, identity threat detection and response, non-human identity management, or identity security posture management capabilities.
Experience with statistical analysis, machine learning, graph analytics, peer-group analysis, entity resolution, or AI-assisted security analytics.
Experience detecting threats involving service accounts, machine identities, workload identities, OAuth applications, API keys, certificates, tokens, secrets, or autonomous agents.
Working knowledge of identity and workload services in AWS, Azure, or Google Cloud.
Experience with identity providers, privileged-access management, secrets-management, cloud identity, CI/CD, container, and workload orchestration technologies.
Experience translating threat hunts, incident findings, or purple-team results into production detections and automated response workflows.
Familiarity with MITRE ATT&CK and identity-focused threat frameworks, behavioral detection methodologies, and detection-as-code practices.
Experience supporting governance, privacy, compliance, or audit requirements associated with identity and behavioral telemetry.

Responsibilities

Design, deploy, integrate, and optimize EUBA and NHIBA platforms and capabilities.
Aggregate and normalize telemetry from identity providers, endpoints, applications, cloud platforms, APIs, privileged-access systems, service accounts, secrets platforms, and automated workloads.
Develop behavioral baselines and analytics for workforce, privileged, service, machine, application, workload, and agent identities.
Develop behavioral risk models and detections for anomalous access, credential misuse, privilege escalation, unusual resource interaction, lateral movement, and deviations from expected behavior.
Evaluate detection performance, false positives, model drift, telemetry quality, and coverage gaps; tune analytics to improve precision and operational value.
Integrate behavioral findings into SIEM, XDR, SOAR, identity threat detection and response, and case-management workflows.
Serve as a technical escalation point for complex behavioral anomalies involving human and non-human identities.
Establish methods to discover, classify, inventory, and monitor non-human identities across cloud, SaaS, on-premises, development, and automation environments.
Analyze authentication, authorization, privilege use, credential and token activity, secrets access, API behavior, workload communication, and resource-interaction patterns.
Correlate identity behavior with ownership, business purpose, privilege, application dependencies, data sensitivity, asset exposure, and lifecycle status.
Partner with IAM, PAM, IT, Engineering, application owners, and platform teams to improve telemetry, identity attribution, ownership data, and remediation workflows.
Automate investigation, enrichment, risk scoring, containment, credential rotation, access restriction, and escalation workflows for high-confidence anomalies.
Define and monitor measures including identity coverage, ownership attribution, behavioral-baseline coverage, detection precision, investigation time, remediation performance, and reduction in unmanaged or high-risk non-human identities.
Correlate identity, endpoint, network, application, cloud, data, and access telemetry to identify suspicious cross-domain activity.
Validate telemetry completeness, timeliness, context, and attribution; identify visibility gaps and lead cross-functional improvements.
Translate threat intelligence, incident findings, purple-team results, and emerging attack techniques into behavioral hypotheses and analytics.
Conduct control-efficacy testing and provide technical recommendations on telemetry architecture, analytics platforms, behavioral models, and response controls.
Lead hypothesis-driven threat hunts focused on anomalous human and non-human identity behavior; document hunts mapped to MITRE ATT&CK and relevant threat intelligence.
Investigate behavioral outliers through root-cause analysis, timeline reconstruction, entity relationship mapping, and validation with identity or application owners.
Standardize hunt hypotheses, data requirements, analysis methods, findings, and outcomes; convert successful hunts and incident findings into durable analytics and response logic.
Build and maintain automated workflows that enrich anomalies with identity, asset, privilege, ownership, application, threat-intelligence, and historical context.
Evaluate and operationalize statistical, machine-learning, graph, peer-group, and AI-assisted techniques for anomaly detection and behavioral analysis.
Define analytics and model validation methods, including precision, recall, false-positive rate, detection latency, coverage, model drift, and analyst feedback.
Apply explainability and supporting evidence to behavioral findings, and establish safeguards and human-review requirements for automated actions.
Measure and improve the impact of analytics and automation on detection, investigation, and containment time, analyst effort, and threat-actor dwell time.
Mentor junior and mid-level security engineers and provide technical guidance and day-to-day escalation support.
Lead technical design and implementation of behavioral analytics, identity detection, telemetry integration, and automated response initiatives; produce architecture documentation, detection specifications, runbooks, and knowledge artifacts.
Participate in hiring, including technical interviews and candidate assessments.
Represent security engineering in cross-functional technical discussions and communicate security requirements and findings to technical and non-technical stakeholders.