Security Engineer

Posting Type

Hybrid/Remote

Job Overview

Job Description and Requirements

• Implement, configure, and maintain security controls that span perimeter, network, host, application, identity and data layers, ensuring and maintaining effectiveness of controls at each layer.
• Collaborate cross-functionally to ensure controls are deployed effectively and aligned to industry recognized frameworks.
• Validate that telemetry from each layer feeds the central analytics platforms and supports 360-degree visibility and appropriate attack surface coverage.
• Monitor control effectiveness and identify opportunities to improve visibility, coverage, and detection capabilities.
• Participate in security assessments, control validation exercises, and purple-team activities.
• Support remediation of identified security gaps, vulnerabilities, and control deficiencies.
• Contribute technical recommendations regarding security tools, configurations, and operational improvements.
• Assist in maintaining complementary security capabilities to prevent bypasses and ensure failure of redundancy through all security layers.

• Deploy, configure, and administer EDR/XDR platforms.
• Implement and maintain endpoint and image hardening baselines, configuration standards, and application control baselines.
• Monitor endpoint telemetry and validate proper integration into the central analytics platform (or SIEM) to support security context and cross-domain correlation; ensure SIEM coverage is adequate and effective.
• Collaborate cross-functionally to ensure security events, exposures, vulnerabilities and alerts are remediated within appropriate SLA’s.
• Investigate endpoint-based alerts and incidents through to root cause: perform triage, forensic artifact collection (memory, disk, logs), timeline reconstruction, and containment/eradication actions.

• Analyze security telemetry to surface anomalous and malicious behavior to the relevant stakeholders.
• Execute structured hunts mapped to MITRE ATT&CK and ATLAS techniques and current threat intelligence.
• Document hunt hypotheses, outcomes and recommendations.
• Assist in investigation of identified vulnerabilities, zero-day, alert telemetry, threat intelligence feeds and notifications from partners and customers and conclude on exploitability risk and/or exposure.
• Maintain awareness of the evolving threat landscape, adversary TTP’s, and emerging vulnerabilities and their relevance to Relativity’s technical ecosystem and organizational trajectory.
• Develop and tune detection rules, correlation logic, and alerting use cases within approved platforms.
• Convert successful hunts, exposure analysis, purple team findings and alerts into durable, automated detections and containment logic and improved coverage.

• Build and maintain SOAR workflows that automate enrichment, triage, containment, and routine response actions.
• Support implementation of SOAR playbooks and automated response capabilities and detection engineering.
• Develop scripts and tooling using supported scripting languages such as Python, PowerShell, or Bash.
• Measure and continuously improve the impact of automation on time-based detection, containment and response to reduce threat actor dwell time.
• Assist in evaluating and operationalizing AI/ML capabilities for semantic anomaly detection, behavioral analytics, alert triage, and prioritization.

• Support deployment and operation of data classification, discovery, and data security posture management across cloud and on-premises stores.
• Deploy and tune data loss prevention controls across endpoints, network, email, cloud and SaaS surfaces.
• Assist in integrating data-related telemetry into centralized monitoring and detection capabilities.
• Monitor data security alerts and investigate potential data protection concerns.
• Investigate data key risk indicators associated with data access, exfiltration, and integrating data telemetry into central analytics (SIEM).

• Support vulnerability and exposure management programs through validation, prioritization, and remediation activities.
• Assist in identifying attack surface gaps across endpoint, identity, cloud, network, and data domains.
• Validate implementation of compensating controls and mitigation actions.
• Participate in exposure assessments and attack surface analysis activities.
• Contribute to risk-based prioritization and remediation recommendations.

• Familiarity with enterprise security concepts across network, endpoint, identity, cloud, and data security domains.
• Basic knowledge of industry standard common security benchmarks and frameworks (e.g., MITRE, NIST, etc.).
• Proficiency in at least one scripting/automation language (Python, Bash, or PowerShell) applied to modern containerized services, CLI based commands, and/or security specific use cases.
• Experience investigating security alerts, incidents, or suspicious activity.
• Ability to communicate technical findings clearly to both engineering peers and non-technical stakeholders.

• Bachelor’s in Computer Science, Information Security, equivalent experience or security certification(s). (e.g., CompTIA Sec+, CompTIA Net+, ISC2 SSCP, etc...)
• Basic knowledge of common cloud environments such as AWS, Azure or GCP.
• Hands-on experience in enterprise security engineering, with a focus on detection and response, red teaming, or ethical hacking.
• Hands-on experience with common security tools such as EDR, XDR, SIEM, CNAPP, CSPM, CWP, etc. and intermediate knowledge of applicable security technologies at all layers of the OSI model.
• Exposure to threat modeling, threat hunting, digital forensics, and/or detection engineering and writing automation scripts and rules for security enforcement and/or observability.
• Familiarity with AI-enabled SecOps (e.g., detection: UEBA, ML-based alert prioritization, or AI-assisted threat hunting workflows).
• Working knowledge of software development lifecycle, software engineering practices or infrastructure as code environments.
• Experience supporting compliance and audit requirements (SOC 2, ISO 27001, HIPAA) from a technical control perspective.