AI-Enabled Security Engineer Threat & SOAR

Position: AI-Enabled Security Engineer for Threat Hunting & SOAR
Advanced Security Engineer, Enterprise Security

United States, New Hampshire, Manchester

Posting Type

Remote/Hybrid

Job Overview

The Advanced Security Engineer is a technically deep, hands-on practitioner who forms the operational backbone of the enterprise security function. Operating within a layered defense-in-depth program, this engineer owns the design, deployment, implementation and optimization of AI-enabled security technologies at all layers. With the goal of enabling automated orchestration of security operations into day-to-day detection and response capabilities, hardening rigor, and rapid response.

This role works closely with the Senior Manager of Enterprise Security and cross-functional engineering teams to reduce the organization's attack surface, enable threat landscape adaptability, and improve detection and response times across Relativity's technical ecosystem.

Posting Type

Remote/Hybrid

Job Overview

The Advanced Security Engineer is a technically deep, hands-on practitioner who forms the operational backbone of the enterprise security function. Operating within a layered defense-in-depth program, this engineer owns the design, deployment, implementation and optimization of AI-enabled security technologies at all layers. With the goal of enabling automated orchestration of security operations into day-to-day detection and response capabilities, hardening rigor, and rapid response.

This role works closely with the Senior Manager of Enterprise Security and cross-functional engineering teams to reduce the organization's attack surface, enable threat landscape adaptability, and improve detection and response times across Relativity's technical ecosystem.

Job Description and Requirements

Layered Defense/Defense in Depth

• As applicable, design, deploy and optimize security controls that span perimeter, network, host, application, identity and data layers, ensuring and maintaining effectiveness of controls at each layer.
• Collaborate cross-functionally to ensure controls are aligned to industry recognized frameworks.
• Validate that telemetry from each layer feeds the central analytics platforms and supports 360-degree visibility and appropriate attack surface coverage.
• Continuously assess effectiveness of enterprise security controls as the ecosystem expands and the threat landscape evolves, supplement or extend coverage accordingly.
• Proactively partner with IT, Engineering and other stakeholders to embed security controls natively.
• Periodically provide recommendations on technical design of security controls aligned to vulnerabilities, risks, issues and/or events.
• Support purple-team exercises and control-efficacy testing to verify depth and resilience under attack conditions.
• Ensure redundant, complementary security capabilities to prevent bypasses and ensure failure redundancy through all security layers.

Endpoint Security & Hardening

• Deploy, integrate, optimize and manage EDR/XDR platforms and periodically define custom detections and automated response actions across security tooling.
• Establish and enforce endpoint and image hardening baselines, configuration standards, and application control baselines.
• Integrate endpoint telemetry into the central analytics platform (or SIEM) to support security context and cross-domain correlation; ensure SIEM coverage is adequate and effective.
• Collaborate cross-functionally to ensure security events, exposures, vulnerabilities and alerts are remediated within appropriate SLA's.
• Investigate endpoint-based alerts and incidents through to root cause: perform triage, forensic artifact collection (memory, disk, logs), timeline reconstruction, and containment/eradication actions.

Threat Hunting

• Collaborate cross-functionally to support purple team exercises and analyze security telemetry to surface anomalous and malicious behavior to the relevant stakeholders.
• Develop, execute and document structured hunts mapped to MITRE ATT&CK and ATLAS techniques and current threat intelligence.
• Perform exposure analysis on identified vulnerabilities, zero-day, alert telemetry, threat intelligence feeds and notifications from partners and customers and conclude on exploitability risk and/or exposure.
• Maintain awareness of the evolving threat landscape, adversary TTP's, and emerging vulnerabilities and their relevance to Relativity's technical ecosystem and organizational trajectory.
• Standardize and document hunt methodology, hypotheses, and outcomes and collaborate with security stakeholders to mature threat hunting program over time.
• Convert successful hunts, exposure analysis, purple team findings and alerts into durable, automated detections and containment logic and improved coverage.

AI-Enabled Security Operations

• Build and maintain SOAR workflows that automate enrichment, triage, containment, and routine response actions.
• Measure and continuously improve the impact of automation on time-based detection, containment and response to reduce threat actor dwell time.
• Identify, evaluate and operationalize…