Senior Security Engineer - EUBA & NHIBA

Posting Type Hyrbid/Remote Job Overview The Senior Security Engineer is a technically deep, hands-on practitioner who advances the enterprise security function through behavioral analytics, detection engineering, technical project leadership, cross-functional collaboration, and mentorship. Operating within a layered defense-in-depth program, this engineer owns complex initiatives that combine identity, endpoint, application, cloud, and access telemetry to identify anomalous activity across human and non-human identities. The role serves as a technical escalation point and force multiplier for the security engineering team, improving behavioral visibility, detection efficacy, investigation quality, and automated response across Relativity’s technical ecosystem. This role will have a primary focus on Entity and User Behavior Analytics (EUBA) and Non-Human Identity Behavior Analytics (NHIBA), including the design, deployment, and optimization of capabilities that identify anomalous and high-risk activity across workforce users, privileged accounts, service accounts, machine identities, applications, and automated workloads. The engineer will integrate identity, endpoint, application, and access telemetry to establish behavioral baselines, develop risk-based detections, and automate investigation and response. By applying analytics, policy-based controls, and threat intelligence, this role will strengthen the organization’s ability to detect identity misuse, credential compromise, privilege abuse, and emerging threats across the broader defense-in-depth and security operations ecosystem. Job Description and Requirements Behavioral Analytics Engineering Design, deploy, integrate, and optimize platforms and capabilities supporting Entity and User Behavior Analytics and Non-Human Identity Behavior Analytics. Aggregate and normalize telemetry from identity providers, endpoints, applications, cloud platforms, APIs, privileged-access systems, service accounts, secrets platforms, and automated workloads. Develop and maintain behavioral baselines for workforce users, privileged identities, service accounts, machine identities, applications, agents, and other automated entities. Engineer analytics that identify anomalous access, credential misuse, privilege escalation, unusual resource interaction, abnormal execution patterns, lateral movement, and deviations from expected identity behavior. Develop behavioral risk models that combine identity sensitivity, privilege, asset context, access patterns, threat intelligence, and observed activity. Evaluate detection performance, false-positive rates, behavioral model drift, telemetry quality, and coverage gaps; continuously tune analytics to improve precision and operational value. Integrate behavioral findings into SIEM, XDR, SOAR, identity threat detection and response, and case-management workflows. Serve as a technical escalation point for complex behavioral anomalies involving human and non-human identities. Human and Non-Human Identity Analytics Lead the design and optimization of behavioral detection capabilities across workforce, privileged, service, machine, application, workload, and agent identities. Establish methods for discovering, classifying, inventorying, and monitoring non-human identities across cloud, SaaS, on-premises, development, and automation environments. Analyze authentication, authorization, privilege use, credential activity, token use, secrets access, API behavior, workload communication, and resource-interaction patterns. Develop detections for dormant or abandoned identities, shared credentials, unexpected privilege use, credential rotation failures, unauthorized token activity, anomalous service-account behavior, and deviations from an identity’s intended purpose. Correlate identity behavior with ownership, business purpose, privilege level, application dependencies, data sensitivity, asset exposure, and lifecycle status. Partner with IAM, PAM, IT, Engineering, application owners, and platform teams to improve telemetry, identity attribution, ownership data, and remediation workflows. Automate investigation, enrichment, risk scoring, containment, credential rotation, access restriction, and escalation workflows for high-confidence behavioral anomalies. Define and monitor measures such as identity coverage, attributable ownership, behavioral-baseline coverage, detection precision, anomaly investigation time, remediation performance, and reduction in unmanaged or high-risk non-human identities. Cross-Domain Behavioral Detection Correlate identity, endpoint, network, application, cloud, data, and access telemetry to identify activity that may appear legitimate within an individual control domain but becomes suspicious when viewed across the environment. Design behavioral detections that account for entity relationships, privilege, asset sensitivity, historical activity, peer-group behavior, and expected business use. Validate that security telemetry is sufficiently complete, timely, contextualized, and attributable to support reliable behavioral analytics. Identify visibility gaps that prevent effective monitoring of human or non-human identities and lead cross-functional efforts to improve telemetry and context. Translate threat intelligence, incident findings, purple-team results, and emerging attack techniques into new behavioral hypotheses and analytics. Conduct control-efficacy testing to validate that behavioral detections identify identity misuse, credential compromise, privilege abuse, lateral movement, and automated workload anomalies. Provide technical recommendations on telemetry architecture, analytics platforms, behavioral models, and response controls. Ensure behavioral analytics complement preventive controls and provide detection coverage when individual controls are bypassed or fail. Threat Hunting Lead hypothesis-driven threat hunts focused on anomalous human and non