Windows & AD Security Engineer — Threat Hunting

Palantir; Washington (District of Columbia); On-site; USD 145,000 - 200,000; Full time

Benefits offered by this job

Medical, dental, vision insurance

Voluntary life insurance

401k plan

PTO and holidays

Paid parental leave

Commuter benefits

Job summary

Palantir is seeking an Information Security Engineer focused on Windows and Active Directory to own the security of Palantir's global Windows infrastructure. You will lead 24/7 prevention, detection, and investigation of security events across the environment.

The role demands deep AD expertise, Windows internals knowledge, and experience with threat hunting and red-teaming. You will drive automation, tooling, and architectural improvements to reduce risk.

Qualifications

• 5+ years of hands‑on security experience, with the majority focused on Windows environments and Active Directory.
• Experience investigating and detecting AD attacks across the full kill chain — enumeration through domain dominance.
• Proficiency with threat hunting tooling and low-level Windows analysis.
• Public contributions: talks, blogs, or open‑source tooling.

Responsibilities

• Own the security posture of Palantir's Windows and Active Directory estate — hardening, configuration standards, and ongoing validation.
• Reduce AD attack surface by auditing and remediating misconfigurations, legacy protocols, excessive privilege, and Kerberos delegation abuse.
• Evaluate, deploy, and own the configuration of defensive tooling across Windows: EDR, PAM, identity threat detection, and endpoint hardening controls.
• Build and maintain automation for security operations across Windows infrastructure — patching pipelines, drift monitoring, access reviews, credential hygiene.
• Partner with Identity and Infrastructure teams to drive architectural improvements: tiered administration, Protected Users, LAPS, Credential Guard, and auth silos.
• Translate findings from assessments and red team exercises into durable fixes — changes, architectural improvements, policy updates.

Skills

Windows security

Active Directory

Threat detection

Incident response

Adversary simulation

Forensics

Python/PowerShell

Public talks/research

Cloud/hybrid identity

Threat hunting

Tools

BloodHound

Impacket

Rubeus

Mimikatz

CrackMapExec

WinDbg

Process Monitor

Volatility

x64dbg

Job description

Palantir is seeking an Information Security Engineer focused on Windows and Active Directory to own the security of Palantir's global Windows infrastructure. You will lead 24/7 prevention, detection, and investigation of security events across the environment.

The role demands deep AD expertise, Windows internals knowledge, and experience with threat hunting and red-teaming. You will drive automation, tooling, and architectural improvements to reduce risk.