Security Engineer

Posting Type Hybrid/Remote Job Overview The Security Engineer is a security practitioner responsible for implementing, operating, and continuously improving enterprise security capabilities across endpoint, network, identity, cloud, and data security domains. Operating within Relativity’s layered defense-in-depth program, this engineer independently executes security engineering initiatives, investigates security events and exposures, develops security automation, and partners with cross-functional teams to improve security visibility, resilience, and operational effectiveness.

This role contributes to detection and response capabilities, security hardening efforts, threat hunting activities, and exposure reduction initiatives while gaining broader expertise across the enterprise security ecosystem.

Implement, configure, and maintain security controls that span perimeter, network, host, application, identity and data layers, ensuring and maintaining effectiveness of controls at each layer. Collaborate cross-functionally to ensure controls are deployed effectively and aligned to industry recognized frameworks. Validate that telemetry from each layer feeds the central analytics platforms and supports 360-degree visibility and appropriate attack surface coverage. Monitor control effectiveness and identify opportunities to improve visibility, coverage, and detection capabilities.

Participate in security assessments, control validation exercises, and purple-team activities. Support remediation of identified security gaps, vulnerabilities, and control deficiencies. Contribute technical recommendations regarding security tools, configurations, and operational improvements. Assist in maintaining complementary security capabilities to prevent bypasses and ensure failure of redundancy through all security layers.

Deploy, configure, and administer EDR/XDR platforms. Implement and maintain endpoint and image hardening baselines, configuration standards, and application control baselines. Monitor endpoint telemetry and validate proper integration into the central analytics platform (or SIEM) to support security context and cross-domain correlation; ensure SIEM coverage is adequate and effective. Collaborate cross-functionally to ensure security events, exposures, vulnerabilities and alerts are remediated within appropriate SLA’s.

Investigate endpoint-based alerts and incidents through to root cause: perform triage, forensic artifact collection (memory, disk, logs), timeline reconstruction, and containment/eradication actions.

Analyze security telemetry to surface anomalous and malicious behavior to the relevant stakeholders. Execute structured hunts mapped to MITRE ATT&CK and ATLAS techniques and current threat intelligence. Document hunt hypotheses, outcomes and recommendations. Assist in investigation of identified vulnerabilities, zero-day, alert telemetry, threat intelligence feeds and notifications from partners and customers and conclude on exploitability risk and/or exposure. Maintain awareness of the evolving threat landscape, adversary TTP’s, and emerging vulnerabilities and their relevance to Relativity’s technical ecosystem and organizational trajectory.

Develop and tune detection rules, correlation logic, and alerting use cases within approved platforms. Convert successful hunts, exposure analysis, purple team findings and alerts into durable, automated detections and containment logic and improved coverage.

Build and maintain SOAR workflows that automate enrichment, triage, containment, and routine response actions. Support…