Senior Security Engineer - EUBA & NHIBA

The Senior Security Engineer is a technically deep, hands‑on practitioner who advances the enterprise security function through behavioral analytics, detection engineering, technical project leadership, cross‑functional collaboration, and mentorship. Operating within a layered defense‑in‑depth program, this engineer owns complex initiatives that combine identity, endpoint, application, cloud, and access telemetry to identify anomalous activity across human and non‑human identities. The role serves as a technical escalation point and force multiplier for the security engineering team, improving behavioral visibility, detection efficacy, investigation quality, and automated response across Relativity’s technical ecosystem.

This role will have a primary focus on Entity and User Behavior Analytics (EUBA) and Non‑Human Identity Behavior Analytics (NHIBA), including the design, deployment, and optimization of capabilities that identify anomalous and high‑risk activity across workforce users, privileged accounts, service accounts, machine identities, applications, and automated workloads. The engineer will integrate identity, endpoint, application, and access telemetry to establish behavioral baselines, develop risk‑based detections, and automate investigation and response.

By applying analytics, policy‑based controls, and threat intelligence, this role will strengthen the organization’s ability to detect identity misuse, credential compromise, privilege abuse, and emerging threats across the broader defense‑in‑depth and security operations ecosystem.

Design, deploy, integrate, and optimize platforms and capabilities supporting Entity and User Behavior Analytics and Non‑Human Identity Behavior Analytics. Aggregate and normalize telemetry from identity providers, endpoints, applications, cloud platforms, APIs, privileged‑access systems, service accounts, secrets platforms, and automated workloads. Develop and maintain behavioral baselines for workforce users, privileged identities, service accounts, machine identities, applications, agents, and other automated entities. Engineer analytics that identify anomalous access, credential misuse, privilege escalation, unusual resource interaction, abnormal execution patterns, lateral movement, and deviations from expected identity behavior.

Develop behavioral risk models that combine identity sensitivity, privilege, asset context, access patterns, threat intelligence, and observed activity. Evaluate detection performance, false‑positive rates, behavioral model drift, telemetry quality, and coverage gaps; continuously tune analytics to improve precision and operational value. Integrate behavioral findings into SIEM, XDR, SOAR, identity threat detection and response, and case‑management workflows. Serve as a technical escalation point for complex behavioral anomalies involving human and non‑human identities.

Lead the design and optimization of behavioral detection capabilities across workforce, privileged, service, machine, application, workload, and agent identities. Establish methods for discovering, classifying, inventorying, and monitoring non‑human identities across cloud, SaaS, on‑premises, development, and automation environments. Analyze authentication, authorization, privilege use, credential activity, token use, secrets access, API behavior, workload communication, and resource‑interaction patterns. Develop detections for dormant or abandoned identities, shared credentials, unexpected privilege use, credential rotation failures, unauthorized token activity, anomalous service‑account behavior, and deviations from an identity’s…