Palantir
Palantir14d ago

Information Security Engineer - Endpoint

Washington, D.C.Full-timemid
SecurityOtherInformation Security Engineer
0 views0 saves0 applied

Quick Summary

Overview

A World-Changing Company Palantir builds the world’s leading software for data-driven decisions and operations. By bringing the right data to the people who need it,

Technical Tools
SecurityOtherInformation Security Engineer
A World-Changing Company
 
Palantir builds the world’s leading software for data-driven decisions and operations. By bringing the right data to the people who need it, our platforms empower our partners to develop lifesaving drugs, forecast supply chain disruptions, locate missing children, and more.

We're looking for someone who has spent years thinking adversarially about Windows and Active Directory — not just operating them, but understanding every layer of how they can be abused, detected, and hardened. If you've written detections for DCSync, built hunting pipelines around Kerberos ticket anomalies, or reverse-engineered a novel persistence mechanism in a Windows kernel driver, this is the team you want to be on.

As an Information Security Engineer focused on Windows and Active Directory, you'll own the security of Palantir's global Windows infrastructure. Your team runs 24/7 prevention, detection, and investigation of security events across our entire environment. The adversaries we face are sophisticated. We need someone who is more so.
 
  • Own the security posture of Palantir's Windows and Active Directory estate — hardening, configuration standards, and ongoing validation that those standards hold.
  • Reduce attack surface across AD: audit and remediate misconfigurations, legacy protocol exposure, excessive privilege, Kerberos delegation abuse, and tier model violations.
  • Evaluate, deploy, and own the configuration of defensive tooling across the Windows environment: EDR, PAM, identity threat detection, and endpoint hardening controls.
  • Build and maintain automation for security operations across Windows infrastructure — patching pipelines, configuration drift monitoring, access reviews, and credential hygiene.
  • Partner with Identity and Infrastructure teams to drive architectural improvements: tiered administration, Protected Users, LAPS, Credential Guard, and authentication policy silos.
  • Translate findings from assessments and red team exercises into durable fixes — configuration changes, architectural improvements, and policy updates that reduce recurrence.
  • Active Directory
  • Deep, working knowledge of AD architecture: sites and services, replication, trust relationships, delegation models, and the LDAP schema.
  • Hands-on experience investigating and detecting AD attacks across the full kill chain — from initial enumeration through domain dominance.
  • Familiarity with attack tooling (BloodHound, Impacket, Rubeus, Mimikatz, CrackMapExec) and, critically, what they leave behind.
  • Experience hardening AD environments: tiered administration, Protected Users, LAPS, Credential Guard, PAM trusts, and authentication policy silos.
  • Windows Internals
  • Thorough understanding of Windows security architecture: access tokens, privilege model, integrity levels, LSASS and credential storage, SAM, and the Security Reference Monitor.
  • Ability to read and interpret Windows kernel structures, driver behavior, and undocumented APIs when necessary.
  • Proficiency with low-level analysis tools: WinDbg, Process Monitor, Process Hacker, Volatility, and x64dbg.
  • Experience with ETW-based telemetry pipelines and building detections on top of raw Windows event data.
  • Detection & Response
  • Proven track record writing high-fidelity detection logic, not just tuning vendor signatures.
  • Experience leading complex incident response investigations, including those involving nation-state or sophisticated criminal actors.
  • Strong forensic fundamentals across disk, memory, and network artifacts on Windows systems.
  • Experience with Entra ID (Azure AD), hybrid identity architectures, and cloud-based attack paths that pivot through on-prem AD.
  • Prior work in adversary simulation, red teaming, or offensive security research — especially against AD targets.
  • Public contributions: conference talks (BlueHat, BSides, SANS, etc.), blog posts, or open-source tooling.
  • 5+ years of hands-on security experience, with the majority focused on Windows environments and Active Directory.
  • Proficiency in Python or PowerShell for detection development, automation, and forensic tooling.
  • Active TS/SCI security clearance, or eligibility and willingness to obtain one.
  • A portfolio of real work: detections you've written, research you've published, tools you've built, or incidents you've led.
  • Location & Eligibility

    Where is the job
    Location terms not specified
    Who can apply
    Same as job location
    Listed under
    Worldwide

    Listing Details

    Posted
    April 16, 2026
    First seen
    April 16, 2026
    Last seen
    April 30, 2026

    Posting Health

    Days active
    14
    Repost count
    0
    Trust Level
    38%
    Scored at
    April 30, 2026

    Signal breakdown

    freshnesssource trustcontent trustemployer trust
    Palantir

    We build software that empowers organizations to effectively integrate their data, decisions, and operations.

    Employees
    4k+
    Founded
    2003
    View company profile
    Newsletter

    Stay ahead of the market

    Get the latest job openings, salary trends, and hiring insights delivered to your inbox every week.

    A
    B
    C
    D
    Join 12,000+ marketers

    No spam. Unsubscribe at any time.

    PalantirInformation Security Engineer - Endpoint