The posting
Posting Type
Hybrid/Remote
Job Overview
The Security Engineer is a security practitioner responsible for implementing, operating, and continuously improving enterprise security capabilities across endpoint, network, identity, cloud, and data security domains. Operating within Relativity’s layered defense-in-depth program, this engineer independently executes security engineering initiatives, investigates security events and exposures, develops security automation, and partners with cross-functional teams to improve security visibility, resilience, and operational effectiveness.
This role contributes to detection and response capabilities, security hardening efforts, threat hunting activities, and exposure reduction initiatives while gaining broader expertise across the enterprise security ecosystem.
Job Description and Requirements
Layered Defense/Defense in Depth
- Implement, configure, and maintain security controls that span perimeter, network, host, application, identity and data layers, ensuring and maintaining effectiveness of controls at each layer.
- Collaborate cross-functionally to ensure controls are deployed effectively and aligned to industry recognized frameworks.
- Validate that telemetry from each layer feeds the central analytics platforms and supports 360-degree visibility and appropriate attack surface coverage.
- Monitor control effectiveness and identify opportunities to improve visibility, coverage, and detection capabilities.
- Participate in security assessments, control validation exercises, and purple-team activities.
- Support remediation of identified security gaps, vulnerabilities, and control deficiencies.
- Contribute technical recommendations regarding security tools, configurations, and operational improvements.
- Assist in maintaining complementary security capabilities to prevent bypasses and ensure failure of redundancy through all security layers.
Endpoint Security & Hardening
- Deploy, configure, and administer EDR/XDR platforms.
- Implement and maintain endpoint and image hardening baselines, configuration standards, and application control baselines.
- Monitor endpoint telemetry and validate proper integration into the central analytics platform (or SIEM) to support security context and cross-domain correlation; ensure SIEM coverage is adequate and effective.
- Collaborate cross-functionally to ensure security events, exposures, vulnerabilities and alerts are remediated within appropriate SLA’s.
- Investigate endpoint-based alerts and incidents through to root cause: perform triage, forensic artifact collection (memory, disk, logs), timeline reconstruction, and containment/eradication actions.
Threat Hunting and Detection Engineering
- Analyze security telemetry to surface anomalous and malicious behavior to the relevant stakeholders.
- Execute structured hunts mapped to MITRE ATT&CK and ATLAS techniques and current threat intelligence.
- Document hunt hypotheses, outcomes and recommendations.
- Assist in investigation of identified vulnerabilities, zero-day, alert telemetry, threat intelligence feeds and notifications from partners and customers and conclude on exploitability risk and/or exposure.
- Maintain awareness of the evolving threat landscape, adversary TTP’s, and emerging vulnerabilities and their relevance to Relativity’s technical ecosystem and organizational trajectory.
- Develop and tune detection rules, correlation logic, and alerting use cases within approved platforms.
- Convert successful hunts, exposure analysis, purple team findings and alerts into durable, automated detections and containment logic and improved coverage.
AI-Enabled Security Operations
- Build and maintain SOAR workflows that automate enrichment, triage, containment, and routine response actions.
- Support implementation of SOAR playbooks and automated response capabilities and detection engineering.
- Develop scripts and tooling using supported scripting languages such as Python, PowerShell, or Bash.
- Measure and continuously improve the impact of automation on time-based detection, containment and response to reduce threat actor dwell time.
- Assist in evaluating and operationalizing AI/ML capabilities for semantic anomaly detection, behavioral analytics, alert triage, and prioritization.
Data Security
- Support deployment and operation of data classification, discovery, and data security posture management across cloud and on-premises stores.
- Deploy and tune data loss prevention controls across endpoints, network, email, cloud and SaaS surfaces.
- Assist in integrating data-related telemetry into centralized monitoring and detection capabilities.
- Monitor data security alerts and investigate potential data protection concerns.
- Investigate data key risk indicators associated with data access, exfiltration, and integrating data telemetry into central analytics (SIEM).
Vulnerability Management
- Support vulnerability and exposure management programs through validation, prioritization, and remediation activities.
- Assist in identifying attack surface gaps across endpoint, identity, cloud, network, and data domains.
- Validate implementation of compensating controls and mitigation actions.
- Participate in exposure assessments and attack surface analysis activities.
- Contribute to risk-based prioritization and remediation recommendations.
Requirements
Minimum Qualifications:
- Familiarity with enterprise security concepts across network, endpoint, identity, cloud, and data security domains.
- Basic knowledge of industry standard common security benchmarks and frameworks (e.g., MITRE, NIST, etc.).
- Proficiency in at least one scripting/automation language (Python, Bash, or PowerShell) applied to modern containerized services, CLI based commands, and/or security specific use cases.
- Experience investigating security alerts, incidents, or suspicious activity.
- Ability to communicate technical findings clearly to both engineering peers and non-technical stakeholders.
Preferred Qualifications:
- Bachelor’s in Computer Science, Information Security, equivalent experience or security certification(s). (e.g., CompTIA Sec+, CompTIA Net+, ISC2 SSCP, etc...)
- Basic knowledge of common cloud environments such as AWS, Azure or GCP.
- Hands-on experience in enterprise security engineering, with a focus on detection and response, red teaming, or ethical hacking.
- Hands-on experience with common security tools such as EDR, XDR, SIEM, CNAPP, CSPM, CWP, etc. and intermediate knowledge of applicable security technologies at all layers of the OSI model.
- Exposure to threat modeling, threat hunting, digital forensics, and/or detection engineering and writing automation scripts and rules for security enforcement and/or observability.
- Familiarity with AI-enabled SecOps (e.g., detection: UEBA, ML-based alert prioritization, or AI-assisted threat hunting workflows).
- Working knowledge of software development lifecycle, software engineering practices or infrastructure as code environments.
- Experience supporting compliance and audit requirements (SOC 2, ISO 27001, HIPAA) from a technical control perspective.
Relativity is committed to competitive, fair, and equitable compensation practices.
This position is eligible for total compensation which includes a competitive base salary, an annual performance bonus, and long-term incentives.
The expected salary range for this role is between following values:
$90,000 and $134,000
The final offered salary will be based on several factors, including but not limited to the candidate's depth of experience, skill set, qualifications, and internal pay equity. Hiring at the top end of the range would not be typical, to allow for future meaningful salary growth in this position.
Required Skills:
Cybersecurity, Cyber Threat Intelligence, Information Security, Intrusion Detection, Network Security, Security Architecture Design, Security Audit, Security Engineering, Security Operations, Vulnerability Management
