Senior Security Engineer - EUBA & NHIBA

Relativity ODA LLC; Illinois; Hybrid; USD 170,000 - 210,000; Full time

Job summary

Relativity ODA LLC in Illinois seeks a Senior Security Engineer to advance enterprise security through behavioral analytics, detection engineering, and cross-functional leadership. You will own complex initiatives across identity, endpoint, app, cloud, and access telemetry to detect anomalous activity.

The role focuses on EUBA and NHIBA, building risk-based detections, automating investigations, and strengthening telemetry across SIEM/XDR/SOAR platforms while mentoring the security engineering

Qualifications

• 5+ years in security engineering or equivalent role.
• Experience building detections across identity, endpoint, cloud, and applications.
• Strong collaboration with IAM, IT, engineering, and security teams.

Responsibilities

• Design, deploy, and optimize analytics for identity and non-human identities.
• Develop behavioral baselines and risk models for workforce and machine identities.
• Automate investigations, enrichment, and containment workflows for detected anomalies.
• Integrate findings into SIEM, XDR, and SOAR workflows.

Skills

Behavioral Analytics

Detection Engineering

Telemetry Aggregation

Cross-functional Collaboration

Mentorship

SIEM

XDR

SOAR

Tools

SIEM platforms

XDR tools

IAM systems

Job description

Posting Type

Hyrbid/Remote

Job Overview

The Senior Security Engineer is a technically deep, hands-on practitioner who advances the enterprise security function through behavioral analytics, detection engineering, technical project leadership, cross-functional collaboration, and mentorship. Operating within a layered defense-in-depth program, this engineer owns complex initiatives that combine identity, endpoint, application, cloud, and access telemetry to identify anomalous activity across human and non-human identities. The role serves as a technical escalation point and force multiplier for the security engineering team, improving behavioral visibility, detection efficacy, investigation quality, and automated response across Relativity's technical ecosystem.

This role will have a primary focus on Entity and User Behavior Analytics (EUBA) and Non-Human Identity Behavior Analytics (NHIBA), including the design, deployment, and optimization of capabilities that identify anomalous and high-risk activity across workforce users, privileged accounts, service accounts, machine identities, applications, and automated workloads. The engineer will integrate identity, endpoint, application, and access telemetry to establish behavioral baselines, develop risk-based detections, and automate investigation and response. By applying analytics, policy-based controls, and threat intelligence, this role will strengthen the organization's ability to detect identity misuse, credential compromise, privilege abuse, and emerging threats across the broader defense-in-depth and security operations ecosystem.

Job Description and Requirements

Behavioral Analytics Engineering

• Design, deploy, integrate, and optimize platforms and capabilities supporting Entity and User Behavior Analytics and Non-Human Identity Behavior Analytics.
• Aggregate and normalize telemetry from identity providers, endpoints, applications, cloud platforms, APIs, privileged-access systems, service accounts, secrets platforms, and automated workloads.
• Develop and maintain behavioral baselines for workforce users, privileged identities, service accounts, machine identities, applications, agents, and other automated entities.
• Engineer analytics that identify anomalous access, credential misuse, privilege escalation, unusual resource interaction, abnormal execution patterns, lateral movement, and deviations from expected identity behavior.
• Develop behavioral risk models that combine identity sensitivity, privilege, asset context, access patterns, threat intelligence, and observed activity.
• Evaluate detection performance, false-positive rates, behavioral model drift, telemetry quality, and coverage gaps; continuously tune analytics to improve precision and operational value.
• Integrate behavioral findings into SIEM, XDR, SOAR, identity threat detection and response, and case-management workflows.
• Serve as a technical escalation point for complex behavioral anomalies involving human and non-human identities.

Human and Non-Human Identity Analytics

• Lead the design and optimization of behavioral detection capabilities across workforce, privileged, service, machine, application, workload, and agent identities.
• Establish methods for discovering, classifying, inventorying, and monitoring non-human identities across cloud, SaaS, on-premises, development, and automation environments.
• Analyze authentication, authorization, privilege use, credential activity, token use, secrets access, API behavior, workload communication, and resource-interaction patterns.
• Develop detections for dormant or abandoned identities, shared credentials, unexpected privilege use, credential rotation failures, unauthorized token activity, anomalous service-account behavior, and deviations from an identity's intended purpose.
• Correlate identity behavior with ownership, business purpose, privilege level, application dependencies, data sensitivity, asset exposure, and lifecycle status.
• Partner with IAM, PAM, IT, Engineering, application owners, and platform teams to improve telemetry, identity attribution, ownership data, and remediation workflows.
• Automate investigation, enrichment, risk scoring, containment, credential rotation, access restriction, and escalation workflows for high-confidence behavioral anomalies.
• Define and monitor measures such as identity coverage, attributable ownership, behavioral-baseline coverage, detection precision, anomaly investigation time, remediation performance, and reduction in unmanaged or high-risk non-human identities.

Cross-Domain Behavioral Detection

• Correlate identity, endpoint, network, application, cloud, data, and access telemetry to identify activity that may appear legitimate within an individual control domain but becomes suspicious when viewed across the environment.
• Design behavioral detections that account for entity relationships, privilege, asset sensitivity, historical activity, peer-group behavior, and expected business use.
• Validate that security tel