Security Engineer

Posting Type

Hybrid/Remote

Job Overview

Job Description and Requirements

Layered Defense/Defense in Depth

• Implement, configure, and maintain security controls that span perimeter, network, host, application, identity and data layers, ensuring and maintaining effectiveness of controls at each layer.
• Collaborate cross-functionally to ensure controls are deployed effectively and aligned to industry recognized frameworks.
• Validate that telemetry from each layer feeds the central analytics platforms and supports 360-degree visibility and appropriate attack surface coverage.
• Monitor control effectiveness and identify opportunities to improve visibility, coverage, and detection capabilities.
• Participate in security assessments, control validation exercises, and purple-team activities.
• Support remediation of identified security gaps, vulnerabilities, and control deficiencies.
• Contribute technical recommendations regarding security tools, configurations, and operational improvements.
• Assist in maintaining complementary security capabilities to prevent bypasses and ensure failure of redundancy through all security layers.

Endpoint Security & Hardening

• Deploy, configure, and administer EDR/XDR platforms.
• Implement and maintain endpoint and image hardening baselines, configuration standards, and application control baselines.
• Monitor endpoint telemetry and validate proper integration into the central analytics platform (or SIEM) to support security context and cross-domain correlation; ensure SIEM coverage is adequate and effective.
• Collaborate cross-functionally to ensure security events, exposures, vulnerabilities and alerts are remediated within appropriate SLA’s.
• Investigate endpoint-based alerts and incidents through to root cause: perform triage, forensic artifact collection (memory, disk, logs), timeline reconstruction, and containment/eradication actions.

Threat Hunting and Detection Engineering

• Analyze security telemetry to surface anomalous and malicious behavior to the relevant stakeholders.
• Execute structured hunts mapped to MITRE ATT&CK and ATLAS techniques and current threat intelligence.
• Document hunt hypotheses, outcomes and recommendations.
• Assist in investigation of identified vulnerabilities, zero-day, alert telemetry, threat intelligence feeds and notifications from partners and customers and conclude on exploitability risk and/or exposure.
• Maintain awareness of the evolving threat landscape, adversary TTP’s, and emerging vulnerabilities and their relevance to Relativity’s technical ecosystem and organizational trajectory.
• Develop and tune detection rules, correlation logic, and alerting use cases within approved platforms.
• Convert successful hunts, exposure analysis, purple team findings and alerts into durable, automated detections and containment logic and improved coverage.

AI-Enabled Security Operations

• Build and maintain SOAR workflows that automate enrichment, triage, containment, and routine response actions.
• Support implementation of SOAR playbooks and automated response capabilities and detection engineering.
• Develop scripts and tooling using supported scripting languages such as Python, PowerShell, or Bash.
• Measure and continuously improve the impact of automation on time-based detection, containment and response to reduce threat actor dwell time.
• Assist in evaluating and operationalizing AI/ML capabilities for semantic anomaly detection, behavioral analytics, alert triage, and prioritization.

Data Security

• Support deployment and operation of data classification, discovery, and data security posture management across cloud and on-premises stores.
• Deploy and tune data loss prevention controls across endpoints, network, email, cloud and SaaS surfaces.
• Assist in integrating data-related telemetry into centralized monitoring and detection capabilities.
• Monitor data security alerts and investigate potential data protection concerns.
• Investigate data key risk indicators associated with data access, exfiltration, and integrating data telemetry into central analytics (SIEM).

Vulnerability Management

• Support vulnerability and exposure management programs through validation, prioritization, and remediation activities.
• Assist in identifying attack surface gaps across endpoint, identity, cloud, network, and data domains.
• Validate implementation of compensating controls and mitigation actions.
• Participate in exposure assessments and attack surface analysis activities.
• Contribute to risk-based prioritization and remediation recommendations.

Requirements

Minimum Qualifications:

• Familiarity with enterprise security concepts across network, endpoint, identity, cloud, and data security domains.
• Basic knowledge of industry standard common security benchmarks and frameworks (e.g., MITRE, NIST, etc.).
• Proficiency in at least one scripting/automation language (Python, Bash, or PowerShell) applied to modern containerized services, CLI based commands, and/or security specific use cases.
• Experience investigating security alerts, incidents, or suspicious activity.
• Ability to communicate technical findings clearly to both engineering peers and non-technical stakeholders.

Preferred Qualifications:

• Bachelor’s in Computer Science, Information Security, equivalent experience or security certification(s). (e.g., CompTIA Sec+, CompTIA Net+, ISC2 SSCP, etc...)
• Basic knowledge of common cloud environments such as AWS, Azure or GCP.
• Hands-on experience in enterprise security engineering, with a focus on detection and response, red teaming, or ethical hacking.
• Hands-on experience with common security tools such as EDR, XDR, SIEM, CNAPP, CSPM, CWP, etc. and intermediate knowledge of applicable security technologies at all layers of the OSI model.
• Exposure to threat modeling, threat hunting, digital forensics, and/or detection engineering and writing automation scripts and rules for security enforcement and/or observability.
• Familiarity with AI-enabled SecOps (e.g., detection: UEBA, ML-based alert prioritization, or AI-assisted threat hunting workflows).
• Working knowledge of software development lifecycle, software engineering practices or infrastructure as code environments.
• Experience supporting compliance and audit requirements (SOC 2, ISO 27001, HIPAA) from a technical control perspective.

Relativity is committed to competitive, fair, and equitable compensation practices.

This position is eligible for total compensation which includes a competitive base salary, an annual performance bonus, and long-term incentives.

The expected salary range for this role is between following values:

The final offered salary will be based on several factors, including but not limited to the candidate's depth of experience, skill set, qualifications, and internal pay equity. Hiring at the top end of the range would not be typical, to allow for future meaningful salary growth in this position.

Required Skills:

About Us

We’re solving big data challenges in the legal tech industry, and we’re always looking for more people to join us on the journey. At Relativity, you'll learn cross-functional skills to grow your career and have the chance to make a big impact on our customers, our industry, and our communities. We admire and value our employees, so it’s no surprise that our hiring process is designed to help us really get to know you – and for you to get to know us, too.