Security Engineer

Relativity ODA LLC; Illinois; Hybrid; USD 120,000 - 170,000; Full time

Job summary

Relativity ODA LLC seeks a Security Engineer to advance enterprise security across endpoint, network, identity, cloud, and data domains. You will implement controls, develop automation, and partner with teams to improve visibility, resilience, and incident response.

You will contribute to threat hunting, detection engineering, and AI-enabled security operations, building scalable defenses and orchestrating incident containment.

Qualifications

• Experience deploying and managing security controls across multiple layers.
• Experience with EDR/XDR platforms and endpoint hardening.
• Ability to tune detection rules and SIEM integration.
• Familiarity with MITRE ATT&CK and threat hunting.
• Experience building SOAR workflows and automation.

Responsibilities

• Implement, configure, and maintain layered security controls across perimeter, network, host, application, identity and data layers.
• Monitor telemetry and ensure central analytics platforms and SIEM coverage are effective.
• Investigate endpoint-based alerts and incidents from triage to containment/eradication actions.
• Develop and tune detection rules, correlation logic, and alerting use cases.
• Convert hunts and alerts into durable detections and improved coverage.

Job description

Posting Type

Hybrid/Remote

Job Overview

The Security Engineer is a security practitioner responsible for implementing, operating, and continuously improving enterprise security capabilities across endpoint, network, identity, cloud, and data security domains. Operating within Relativity's layered defense-in-depth program, this engineer independently executes security engineering initiatives, investigates security events and exposures, develops security automation, and partners with cross-functional teams to improve security visibility, resilience, and operational effectiveness.

This role contributes to detection and response capabilities, security hardening efforts, threat hunting activities, and exposure reduction initiatives while gaining broader expertise across the enterprise security ecosystem.

Job Description and Requirements

Layered Defense/Defense in Depth

• Implement, configure, and maintain security controls that span perimeter, network, host, application, identity and data layers, ensuring and maintaining effectiveness of controls at each layer.
• Collaborate cross-functionally to ensure controls are deployed effectively and aligned to industry recognized frameworks.
• Validate that telemetry from each layer feeds the central analytics platforms and supports 360-degree visibility and appropriate attack surface coverage.
• Monitor control effectiveness and identify opportunities to improve visibility, coverage, and detection capabilities.
• Participate in security assessments, control validation exercises, and purple-team activities.
• Support remediation of identified security gaps, vulnerabilities, and control deficiencies.
• Contribute technical recommendations regarding security tools, configurations, and operational improvements.
• Assist in maintaining complementary security capabilities to prevent bypasses and ensure failure of redundancy through all security layers.

Endpoint Security & Hardening

• Deploy, configure, and administer EDR/XDR platforms.
• Implement and maintain endpoint and image hardening baselines, configuration standards, and application control baselines.
• Monitor endpoint telemetry and validate proper integration into the central analytics platform (or SIEM) to support security context and cross-domain correlation; ensure SIEM coverage is adequate and effective.
• Collaborate cross-functionally to ensure security events, exposures, vulnerabilities and alerts are remediated within appropriate SLA's.
• Investigate endpoint-based alerts and incidents through to root cause: perform triage, forensic artifact collection (memory, disk, logs), timeline reconstruction, and containment/eradication actions.

Threat Hunting and Detection Engineering

• Analyze security telemetry to surface anomalous and malicious behavior to the relevant stakeholders.
• Execute structured hunts mapped to MITRE ATT&CK and ATLAS techniques and current threat intelligence.
• Document hunt hypotheses, outcomes and recommendations.
• Assist in investigation of identified vulnerabilities, zero-day, alert telemetry, threat intelligence feeds and notifications from partners and customers and conclude on exploitability risk and/or exposure.
• Maintain awareness of the evolving threat landscape, adversary TTP's, and emerging vulnerabilities and their relevance to Relativity's technical ecosystem and organizational trajectory.
• Develop and tune detection rules, correlation logic, and alerting use cases within approved platforms.
• Convert successful hunts, exposure analysis, purple team findings and alerts into durable, automated detections and containment logic and improved coverage.

AI-Enabled Security Operations

• Build and maintain SOAR workflows that automate enrichment, triage, containment, and routine response actions.
• Support implementation of SOAR playbooks and automated response capabilities and detection engineering.
• Develop scripts and tooling using supported scripting languages such as Python, PowerShell, or Bash.
• Measure and continuously improve the impact of automation on time-based detection, containment and response to reduce threat actor dwell time.
• Assist in evaluating and operationalizing AI/ML capabilities for semantic anomaly detection, behavioral analytics, alert triage, and prioritization.

Data Security

• Support deployment and operation of data classification, discovery, and data security posture management across cloud and on-premises stores.
• Deploy and tune data loss prevention controls across endpoints, network, email, cloud and SaaS surfaces.
• Assist in integrating data-related telemetry into centralized monitoring and detection capabilities.
• Monitor data security alerts and investigate potential data protection concerns.
• Investigate data key risk indicators associated with data access, exfiltration, and integrating data telemetry into central analytics (SIEM).

Vulnerability Management

• Support vulnerability and exposure management programs through validation, prioritization, and remediation activities.
• Assist in identifying