security engineer

Relativity is a technology company that provides software solutions to help users organize their data, discover the truth, and act on it.

• Design, deploy, and optimize security controls that span perimeter, network, host, application, identity, and data layers;
• Collaborate cross-functionally to ensure controls are aligned to industry-recognized frameworks;
• Validate that telemetry from each layer feeds central analytics platforms and supports 360-degree visibility and attack surface coverage;
• Continuously assess the effectiveness of enterprise security controls as the ecosystem expands and the threat landscape evolves;
• Proactively partner with IT, Engineering, and other stakeholders to embed security controls natively;
• Periodically provide recommendations on the technical design of security controls aligned to vulnerabilities, risks, issues, and/or events;
• Support purple-team exercises and control-efficacy testing to verify depth and resilience under attack conditions;
• Ensure redundant, complementary security capabilities to prevent bypasses and ensure failure redundancy through all security layers;
• Deploy, integrate, optimize, and manage EDR/XDR platforms and define custom detections and automated response actions across security tooling;
• Establish and enforce endpoint and image hardening baselines, configuration standards, and application control baselines;
• Integrate endpoint telemetry into the central analytics platform or SIEM to support security context and cross-domain correlation;
• Collaborate cross-functionally to ensure security events, exposures, vulnerabilities, and alerts are remediated within appropriate SLAs;
• Investigate endpoint-based alerts and incidents through to root cause by performing triage, forensic artifact collection, timeline reconstruction, and containment or eradication actions;
• Analyze security telemetry to surface anomalous and malicious behavior to relevant stakeholders;
• Develop, execute, and document structured hunts mapped to MITRE ATT&CK, ATLAS techniques, and current threat intelligence;
• Perform exposure analysis on identified vulnerabilities, zero-days, alert telemetry, threat intelligence feeds, and notifications from partners and customers;
• Maintain awareness of the evolving threat landscape, adversary TTPs, and emerging vulnerabilities and their relevance to the technical ecosystem;
• Standardize and document hunt methodology, hypotheses, and outcomes, and collaborate with security stakeholders to mature the threat hunting program;
• Convert successful hunts, exposure analysis, purple team findings, and alerts into durable, automated detections, containment logic, and improved coverage;
• Build and maintain SOAR workflows that automate enrichment, triage, containment, and routine response actions;
• Measure and continuously improve the impact of automation on time-based detection, containment, and response to reduce threat actor dwell time;
• Identify, evaluate, and operationalize AI/ML capabilities for semantic anomaly detection, behavioral analytics, alert triage, and prioritization;
• Implement data classification, discovery, and data security posture management across cloud and on-premises stores;
• Deploy and tune data loss prevention controls across endpoints, network, email, cloud, and SaaS surfaces;
• Investigate data key risk indicators associated with data access and exfiltration, and integrate data telemetry into the central analytics SIEM.

• Bachelor's degree in Computer Science, Information Security, or equivalent experience;
• 5+ Years of hands-on experience in enterprise security engineering, with a focus on network and/or endpoint security domains, or a Master’s Degree in Cybersecurity or a relevant field;
• Hands-on experience with common security tools such as EDR, XDR, SIEM, CNAPP, CSPM, CWP, and intermediate knowledge of applicable security technologies at all layers of the OSI model;
• Experience with threat hunting, digital forensics, and/or detection engineering, along with writing automation scripts and rules for security enforcement and/or observability;
• Basic knowledge of industry standard common security benchmarks and frameworks such as MITRE and NIST;
• Proficiency in at least one scripting or automation language including Python, Bash, or PowerShell applied to modern containerized services, CLI-based commands, and/or security-specific use cases;
• Ability to communicate technical findings clearly to both engineering peers and non-technical stakeholders;
• Nice to have: Familiarity with AI-enabled SecOps such as UEBA, ML-based alert prioritization, or AI-assisted threat hunting workflows, basic knowledge of common cloud environments like AWS, Azure, or GCP, working knowledge of software development lifecycle, software engineering practices, or infrastructure as code environments, experience supporting compliance and audit requirements including SOC 2, ISO 27001, and HIPAA from a technical control perspective, relevant certifications such as SEC+, CISSP, CISA, GCIH, GCFA, GCIA, GPEN, OSCP, CySA+, or equivalent.

• Competitive base salary, annual performance bonus, and long-term incentives;
• No conditions specified.