Information Security Engineer - Insider Risk

The Role

As an Insider Threat Detection Engineer, you are responsible for protecting Palantir's people, data, and most sensitive assets across the globe. This role focuses on all aspects of Detection and Response with a strong emphasis on identifying and mitigating insider risks, serving as a critical line of defense responsible for 24/7 prevention, detection, and investigation of security events.

Core Responsibilities

• Engineer and automate end-to-end detection and investigation workflows, continuously improving Detection and Response infrastructure.
• Develop alerting and detection strategies to identify malicious or anomalous behavior, adapting to evolving adversary tactics and tradecraft.
• Dissect network, host, memory, and other artifacts originating from multiple operating systems and applications.
• Investigate security events and active attacks across the enterprise, uncovering sophisticated threats and identifying patterns indicating insider risk.
• Influence and inform security controls designed to safeguard Palantir's critical assets.
• Partner closely with other Information Security team members to lead changes in network defense posture.

What We Require

• Extensive security experience (3+ years) in at least one major platform (e.g., AWS, Azure, Windows, OS X, Linux, etc.).
• Proficiency in Python (preferred), PowerShell, or similar.
• Familiarity with endpoint telemetry and log sources from at least one major operating system.
• Experience with common SIEM/SOAR platforms and proficiency writing queries against security event data.
• Active TS/SCI security clearance or eligibility to obtain one.

What We Value

• Broad exposure to multiple security subject areas, including forensics or threat intelligence.
• Deep exposure in Incident Response or Detection Engineering.
• Desire to contribute to the information security community (e.g., conference talks, blog posts, open source tool development).
• Comfort operating autonomously and engaging across business levels to advise on security outcomes.