Senior Security Engineer - EUBA & NHIBA

Posting Type Hyrbid/Remote

Job Overview The Senior Security Engineer is a technically deep, hands-on practitioner who advances the enterprise security function through behavioral analytics, detection engineering, technical project leadership, cross-functional collaboration, and mentorship. Operating within a layered defense-in-depth program, this engineer owns complex initiatives that combine identity, endpoint, application, cloud, and access telemetry to identify anomalous activity across human and non-human identities. The role serves as a technical escalation point and force multiplier for the security engineering team, improving behavioral visibility, detection efficacy, investigation quality, and automated response across Relativity’s technical ecosystem.

This role will have a primary focus on Entity and User Behavior Analytics (EUBA) and Non-Human Identity Behavior Analytics (NHIBA), including the design, deployment, and optimization of capabilities that identify anomalous and high-risk activity across workforce users, privileged accounts, service accounts, machine identities, applications, and automated workloads. The engineer will integrate identity, endpoint, application, and access telemetry to establish behavioral baselines, develop risk-based detections, and automate investigation and response. By applying analytics, policy-based controls, and threat intelligence, this role will strengthen the organization’s ability to detect identity misuse, credential compromise, privilege abuse, and emerging threats across the broader defense-in-depth and security operations ecosystem.

Job Description and Requirements Behavioral Analytics Engineering

• Design, deploy, integrate, and optimize platforms and capabilities supporting Entity and User Behavior Analytics and Non-Human Identity Behavior Analytics.
• Aggregate and normalize telemetry from identity providers, endpoints, applications, cloud platforms, APIs, privileged-access systems, service accounts, secrets platforms, and automated workloads.
• Develop and maintain behavioral baselines for workforce users, privileged identities, service accounts, machine identities, applications, agents, and other automated entities.
• Engineer analytics that identify anomalous access, credential misuse, privilege escalation, unusual resource interaction, abnormal execution patterns, lateral movement, and deviations from expected identity behavior.
• Develop behavioral risk models that combine identity sensitivity, privilege, asset context, access patterns, threat intelligence, and observed activity.
• Evaluate detection performance, false-positive rates, behavioral model drift, telemetry quality, and coverage gaps; continuously tune analytics to improve precision and operational value.
• Integrate behavioral findings into SIEM, XDR, SOAR, identity threat detection and response, and case-management workflows.
• Serve as a technical escalation point for complex behavioral anomalies involving human and non-human identities.

Human and Non-Human Identity Analytics

• Lead the design and optimization of behavioral detection capabilities across workforce, privileged, service, machine, application, workload, and agent identities.
• Establish methods for discovering, classifying, inventorying, and monitoring non-human identities across cloud, SaaS, on-premises, development, and automation environments.
• Analyze authentication, authorization, privilege use, credential activity, token use, secrets access, API behavior, workload communication, and resource-interaction patterns.
• Develop detections for dormant or abandoned identities, shared credentials, unexpected privilege use, credential rotation failures, unauthorized token activity, anomalous service-account behavior, and deviations from an identity’s intended purpose.
• Correlate identity behavior with ownership, business purpose, privilege level, application dependencies, data sensitivity, asset exposure, and lifecycle status.
• Partner with IAM, PAM, IT, Engineering, application owners, and platform teams to improve telemetry, identity attribution, ownership data, and remediation workflows.
• Automate investigation, enrichment, risk scoring, containment, credential rotation, access restriction, and escalation workflows for high-confidence behavioral anomalies.
• Define and monitor measures such as identity coverage, attributable ownership, behavioral-baseline coverage, detection precision, anomaly investigation time, remediation performance, and reduction in unmanaged or high-risk non-human identities.

Cross-Domain Behavioral Detection

• Correlate identity, endpoint, network, application, cloud, data, and access telemetry to identify activity that may appear legitimate within an individual control domain but becomes suspicious when viewed across the environment.
• Design behavioral detections that account for entity relationships, privilege, asset sensitivity, historical activity, peer-group behavior, and expected business use.
• Validate that security telemetry is sufficiently complete, timely, contextualized, and attributable to support reliable behavioral analytics.
• Identify visibility gaps that prevent effective monitoring of human or non-human identities and lead cross-functional efforts to improve telemetry and context.
• Translate threat intelligence, incident findings, purple-team results, and emerging attack techniques into new behavioral hypotheses and analytics.
• Conduct control-efficacy testing to validate that behavioral detections identify identity misuse, credential compromise, privilege abuse, lateral movement, and automated workload anomalies.
• Provide technical recommendations on telemetry architecture, analytics platforms, behavioral models, and response controls.
• Ensure behavioral analytics complement preventive controls and provide detection coverage when individual controls are bypassed or fail.

Threat Hunting

• Lead hypothesis-driven threat hunts focused on anomalous human and non-human identity behavior, including credential misuse, privilege abuse, token theft, lateral movement, service-account compromise, and malicious automation.
• Develop and document hunts mapped to MITRE ATT&CK, relevant identity attack techniques, current threat intelligence, and observed behavioral patterns.
• Analyze activity across identity, endpoint, network, application, cloud, API, secrets-management, and privileged-access telemetry.
• Establish peer groups and expected behavioral patterns to distinguish legitimate operational variance from suspicious activity.
• Investigate behavioral outliers through root-cause analysis, timeline reconstruction, entity relationship mapping, and validation with identity or application owners.
• Standardize hunt hypotheses, data requirements, analysis methods, findings, and outcomes.
• Convert successful hunts, incidents, purple-team findings, and emerging attack patterns into durable analytics, risk models, and automated response logic.

Analytics, Automation, & AI-Enabled Security Operations

• Build and maintain automated workflows that enrich behavioral anomalies with identity, asset, privilege, ownership, application, threat-intelligence, and historical activity context.
• Automate triage, risk scoring, case creation, stakeholder validation, containment, credential rotation, access restriction, and escalation for behavioral detections.
• Evaluate and operationalize statistical, machine-learning, graph, peer-group, and AI-assisted techniques for anomaly detection and behavioral analysis.
• Define validation methods for analytics and models, including precision, recall, false-positive rate, detection latency, coverage, model drift, and analyst feedback.
• Apply explainability and supporting evidence so behavioral findings can be understood, investigated, and acted upon by security analysts and system owners.
• Establish safeguards, monitoring, and human-review requirements for automated investigation or response actions.
• Measure and continuously improve the effect of behavioral analytics and automation on detection time, investigation time, containment time, analyst effort, and threat-actor dwell time.

Leadership & Mentorship

• Serve as a technical mentor and day-to-day escalation point for junior and mid-level security engineers, providing guidance on technical approach, tooling, and professional development.
• Lead the technical design and implementation of behavioral analytics, identity detection, telemetry integration, and automated response initiatives, producing clear architecture documentation, detection specifications, runbooks, and knowledge artifacts for the broader team.
• Participate in hiring processes including technical interviews and candidate assessments.
• Represent the security engineering team in cross-functional technical discussions, translating security requirements and findings clearly for both engineering peers and non-technical stakeholders.

Minimum qualifications:

• 4–8 years of hands-on experience in security engineering, detection engineering, identity security, threat hunting, security analytics, or a related discipline.
• Demonstrated experience developing behavioral analytics, anomaly detections, correlation logic, threat-hunting queries, or risk-scoring methods from security telemetry.
• Experience analyzing activity associated with workforce identities, privileged accounts, service accounts, machine identities, applications, APIs, or cloud workloads.
• Hands-on experience with SIEM, XDR, UEBA/EUBA, identity threat detection and response, SOAR, or comparable security analytics platforms.
• Strong understanding of authentication, authorization, privilege, credentials, tokens, secrets, service accounts, workload identities, and common identity-based attack techniques.
• Experience integrating and analyzing telemetry from identity providers, endpoints, cloud platforms, applications, privileged-access systems, and other enterprise security technologies.
• Proficiency in at least one query, scripting, or programming language such as KQL, SPL, SQL, Python, PowerShell, or equivalent.
• Experience measuring and tuning detection efficacy, including false-positive reduction, coverage analysis, validation, and operationalization of findings.
• Demonstrated experience leading complex security initiatives through design, implementation, testing, stakeholder coordination, and operational adoption.
• Ability to communicate analytical findings, behavioral risk, and technical recommendations to engineering teams, system owners, security analysts, and non-technical stakeholders.
• Relevant certifications in security analytics, cloud security, identity security, incident response, or security engineering such as CySA+, SSCP, Security+, or equivalent.
• Prior experience mentoring or providing technical guidance to junior engineers.

Preferred qualifications:

• Bachelor’s degree in Computer Science, Information Security, Data Science, Engineering, or a related discipline, or equivalent practical experience.
• Experience implementing or operating UEBA, EUBA, identity threat detection and response, non-human identity management, or identity security posture management capabilities.
• Experience with statistical analysis, machine learning, graph analytics, peer-group analysis, entity resolution, or AI-assisted security analytics.
• Experience detecting threats involving service accounts, machine identities, workload identities, OAuth applications, API keys, certificates, tokens, secrets, or autonomous agents.
• Working knowledge of identity and workload services in AWS, Azure, or Google Cloud.
• Experience with identity providers, privileged-access management, secrets-management, cloud identity, CI/CD, container, and workload orchestration technologies.
• Experience translating threat hunts, incident findings, or purple-team results into production detections and automated response workflows.
• Familiarity with MITRE ATT&CK and identity-focused threat frameworks, behavioral detection methodologies, and detection-as-code practices.
• Experience supporting governance, privacy, compliance, or audit requirements associated with identity and behavioral telemetry.

Relativity is committed to competitive, fair, and equitable compensation practices.

This position is eligible for total compensation which includes a competitive base salary, an annual performance bonus, and long-term incentives.

The expected salary range for this role is between following values:

$130,000 and $195,000 The final offered salary will be based on several factors, including but not limited to the candidate's depth of experience, skill set, qualifications, and internal pay equity. Hiring at the top end of the range would not be typical, to allow for future meaningful salary growth in this position.

Required Skills:

Access Management, Application Security, Endpoint Security, Network Security, Penetration Testing, Security Architecture Design, Security Information, Security Information and Event Management (SIEM), Security Operations, Vulnerability Management