Information Security Engineer - Insider Risk

The role

You will engineer and automate detection and investigation workflows and investigate security events and insider risks across Palantir's global environment. You will work on a 24/7 security team that defends against external and internal threats.

What you will do

• Engineer and automate end-to-end detection and investigation workflows
• Develop alerting and detection strategies for malicious or anomalous behavior
• Analyze network, host, memory and other artifacts from multiple operating systems and applications
• Investigate security events and active attacks, including patterns that indicate insider risk
• Influence security controls that protect critical assets
• Partner with the Information Security team to lead changes to network defense posture

Required qualifications

• 3+ years of extensive security experience in at least one major platform (e.g. AWS, Azure, Windows, OS X, Linux)
• Proficiency in Python, PowerShell or similar
• Familiarity with endpoint telemetry and log sources from at least one major operating system
• Experience with common SIEM/SOAR platforms and writing queries against security event data
• Active TS/SCI security clearance or eligibility to obtain one

Nice to have

• Proficiency in Python (listed as preferred; PowerShell or similar also accepted)
• Broad exposure to security subject areas, including forensics or threat intelligence
• Deep exposure in Incident Response or Detection Engineering
• Contributions to the security community, such as conference talks, blog posts or public tool development

Benefits

• Medical, dental and vision insurance, plus voluntary life insurance
• Basic life, AD&D and disability insurance, covered automatically
• Commuter benefits
• Relocation assistance
• Take-what-you-need paid time off, not accrual based
• 2 weeks paid time off at the end of each year (subject to team and business needs)
• 10 paid holidays per year
• Leave of absence program, including military service and medical events
• Paid leave for new parents and subsidized back-up care
• Fertility and family building benefits, including adoption, surrogacy and preservation
• New child expense stipend
• 401k plan

Before you apply

• Requires an active TS/SCI security clearance or eligibility to obtain one
• Remote work is only exceptional for some roles, and then only from the state where you are employed; onsite roles require working from an office

About the company

Palantir builds software for data-driven decisions and operations, used by partners to develop drugs, forecast supply chain disruptions and locate missing children.