Your team runs 24/7 prevention, detection, and investigation of security events across our entire environment. The adversaries we face are sophisticated. We need someone who is more so.

Core Responsibilities

• Own the security posture of Palantir's Windows and Active Directory estate , hardening, configuration standards, and ongoing validation that those standards hold.
• Reduce attack surface across AD: audit and remediate misconfigurations, legacy protocol exposure, excessive privilege, Kerberos delegation abuse, and tier model violations.
• Evaluate, deploy, and own the configuration of defensive tooling across the Windows environment: EDR, PAM, identity threat detection, and endpoint hardening controls.
• Build and maintain automation for security operations across Windows infrastructure , patching pipelines, configuration drift monitoring, access reviews, and credential hygiene.
• Partner with Identity and Infrastructure teams to drive architectural improvements: tiered administration, Protected Users, LAPS, Credential Guard, and authentication policy silos.
• Translate findings from assessments and red team exercises into durable fixes , configuration changes, architectural improvements, and policy updates that reduce recurrence.

What We're Looking For

• Active Directory
• Deep, working knowledge of AD architecture: sites and services, replication, trust relationships, delegation models, and the LDAP schema.
• Hands-on experience investigating and detecting AD attacks across the full kill chain , from initial enumeration through domain dominance.
• Familiarity with attack tooling (BloodHound, Impacket, Rubeus, Mimikatz, CrackMapExec) and, critically, what they leave behind.
• Experience hardening AD environments: tiered administration, Protected Users, LAPS, Credential Guard, PAM trusts, and authentication policy silos.
• Windows Internals
• Thorough understanding of Windows security architecture: access tokens, privilege model, integrity levels, LSASS and credential storage, SAM, and the Security Reference Monitor.
• Ability to read and interpret Windows kernel structures, driver behavior, and undocumented APIs when necessary.
• Proficiency with low-level analysis tools: WinDbg, Process Monitor, Process Hacker, Volatility, and x64dbg.
• Experience with ETW-based telemetry pipelines and building detections on top of raw Windows event data.
• Detection & Response
• Proven track record writing high-fidelity detection logic, not just tuning vendor signatures.
• Experience leading complex incident response investigations, including those involving nation-state or sophisticated criminal actors.
• Strong forensic fundamentals across disk, memory, and network artifacts on Windows systems.

What We Value

• Experience with Entra ID (Azure AD), hybrid identity architectures, and cloud-based attack paths that pivot through on-prem AD.
• Prior work in adversary simulation, red teaming, or offensive security research , especially against AD targets.
• Public contributions: conference talks (BlueHat, BSides, SANS, etc.), blog posts, or open-source tooling.

What We Require

• 5+ years of hands-on security experience, with the majority focused on Windows environments and Active Directory.
• Proficiency in Python or PowerShell for detection development, automation, and forensic tooling.
• Active TS/SCI security clearance, or eligibility and willingness to obtain one.
• A portfolio of real work: detections you've written, research you've published, tools you've built, or incidents you've led.

Additional Information

• The estimated salary range for this position is estimated to be $145,000 - $200,000/year. Total compensation for this position may also include Restricted Stock units, sign-on bonus and other potential future incentives.

XML job scraping automation by YubHub

Core Responsibilities:

• Own the security posture of Palantir's Windows and Active Directory estate , hardening, configuration standards, and ongoing validation that those standards hold.

• Reduce attack surface across AD: audit and remediate misconfigurations, legacy protocol exposure, excessive privilege, Kerberos delegation abuse, and tier model violations.

• Evaluate, deploy, and own the configuration of defensive tooling across the Windows environment: EDR, PAM, identity threat detection, and endpoint hardening controls.

• Build and maintain automation for security operations across Windows infrastructure , patching pipelines, configuration drift monitoring, access reviews, and credential hygiene.

• Partner with Identity and Infrastructure teams to drive architectural improvements: tiered administration, Protected Users, LAPS, Credential Guard, and authentication policy silos.

• Translate findings from assessments and red team exercises into durable fixes , configuration changes, architectural improvements, and policy updates that reduce recurrence.

What We're Looking For:

• Active Directory

• Deep, working knowledge of AD architecture: sites and services, replication, trust relationships, delegation models, and the LDAP schema.

• Hands-on experience investigating and detecting AD attacks across the full kill chain , from initial enumeration through domain dominance.

• Familiarity with attack tooling (BloodHound, Impacket, Rubeus, Mimikatz, CrackMapExec) and, critically, what they leave behind.

• Experience hardening AD environments: tiered administration, Protected Users, LAPS, Credential Guard, PAM trusts, and authentication policy silos.

• Windows Internals

• Thorough understanding of Windows security architecture: access tokens, privilege model, integrity levels, LSASS and credential storage, SAM, and the Security Reference Monitor.

• Ability to read and interpret Windows kernel structures, driver behavior, and undocumented APIs when necessary.

• Proficiency with low-level analysis tools: WinDbg, Process Monitor, Process Hacker, Volatility, and x64dbg.

• Experience with ETW-based telemetry pipelines and building detections on top of raw Windows event data.

• Detection & Response

• Proven track record writing high-fidelity detection logic, not just tuning vendor signatures.

• Experience leading complex incident response investigations, including those involving nation-state or sophisticated criminal actors.

• Strong forensic fundamentals across disk, memory, and network artifacts on Windows systems.

What We Value:

• Experience with Entra ID (Azure AD), hybrid identity architectures, and cloud-based attack paths that pivot through on-prem AD.

• Prior work in adversary simulation, red teaming, or offensive security research , especially against AD targets.

• Public contributions: conference talks (BlueHat, BSides, SANS, etc.), blog posts, or open-source tooling.

What We Require:

• 5+ years of hands-on security experience, with the majority focused on Windows environments and Active Directory.

• Proficiency in Python or PowerShell for detection development, automation, and forensic tooling.

• Active TS/SCI security clearance, or eligibility and willingness to obtain one.

• A portfolio of real work: detections you've written, research you've published, tools you've built, or incidents you've led.

Additional Information:

• The estimated salary range for this position is estimated to be $145,000 - $200,000/year.

• Our benefits aim to promote health and wellbeing across all areas of Palantirians’ lives. We work to continuously improve our offerings and listen to our community as we design and update them.

XML job scraping automation by YubHub

In this role, you'll be the first line of defense for protecting Palantir. Your team is responsible for the 24/7 prevention, detection, and investigation of security events and active attacks across our entire infrastructure. Your work will directly impact the success of Palantir's mission as you seek to make it challenging for our adversaries and protect our global network.

Core Responsibilities

• Build, run, and own infrastructure and automation to detect, contain, and eradicate security threats.
• Develop alerting and detection strategies to identify malicious or anomalous behaviour.
• Develop new and novel defensive techniques to identify or counteract changes in adversary techniques and tactics.
• Dissect network, host, memory, and other artifacts originating from multiple operating systems and applications.
• Investigate enterprise-wide operations to uncover sophisticated and undetected threats.
• Partner closely with other members of the Information Security team to lead changes in the company's network defence posture.

What We Value

• Broad exposure to multiple security subject areas, including a strong background in forensics or threat intelligence.
• Deep exposure in Incident Response or Detection Engineering.
• Desire to further the information security community through substantive contributions (e.g. conference talks, blog posts, public tool development, etc.).
• Strong working knowledge of TCP/IP networking and common protocols.

What We Require

• Extensive security experience (3+ years) in at least one major platform (e.g. AWS, Azure, Windows, OS X, Linux, etc.).
• Proficiency in Python (preferred), PowerShell, or similar.
• Active security clearance or eligibility to obtain a security clearance.

XML job scraping automation by YubHub

In this role, you'll be the first line of defense for protecting Palantir. Your team is responsible for the 24/7 prevention, detection, and investigation of security events and active attacks across our entire infrastructure. Your work will directly impact the success of Palantir's mission as you seek to make it challenging for our adversaries and protect our global network.

Core Responsibilities

• Build, run, and own infrastructure and automation to detect, contain, and eradicate security threats.
• Develop alerting and detection strategies to identify malicious or anomalous behavior.
• Develop new and novel defensive techniques to identify or counteract changes in adversary techniques and tactics.
• Dissect network, host, memory, and other artifacts originating from multiple operating systems and applications.
• Investigate enterprise-wide operations to uncover sophisticated and undetected threats.
• Partner closely with other members of the Information Security team to lead changes in the company's network defense posture.

What We Value

• Broad exposure to multiple security subject areas, including a strong background in forensics or threat intelligence.
• Deep exposure in Incident Response or Detection Engineering.
• Desire to further the information security community through substantive contributions (e.g. conference talks, blog posts, public tool development, etc.).
• Strong working knowledge of TCP/IP networking and common protocols.

What We Require

• Extensive security experience (3+ years) in at least one major platform (e.g. AWS, Azure, Windows, OS X, Linux, etc.).
• Proficiency in Python (preferred), PowerShell, or similar.
• Active TS/SCI security clearance or eligibility to obtain a security clearance.

Additional Information

The estimated salary range for this position is estimated to be $135,000 - $200,000/year. Total compensation for this position may also include Restricted Stock units, sign-on bonus and other potential future incentives.

XML job scraping automation by YubHub

In this role, you'll be the first line of defense for protecting Palantir. Your team is responsible for the 24/7 prevention, detection, and investigation of security events and active attacks across our entire infrastructure. Your work will directly impact the success of Palantir's mission as you seek to make it challenging for our adversaries and protect our global network.

Core Responsibilities:

• Build, run, and own infrastructure and automation to detect, contain, and eradicate security threats.
• Develop alerting and detection strategies to identify malicious or anomalous behavior.
• Develop new and novel defensive techniques to identify or counteract changes in adversary techniques and tactics.
• Dissect network, host, memory, and other artifacts originating from multiple operating systems and applications.
• Investigate enterprise-wide operations to uncover sophisticated and undetected threats.
• Partner closely with other members of the Information Security team to lead changes in the company's network defense posture.

What We Value:

• Broad exposure to multiple security subject areas, including a strong background in forensics or threat intelligence.
• Deep exposure in Incident Response or Detection Engineering.
• Desire to further the information security community through substantive contributions (e.g. conference talks, blog posts, public tool development, etc.).
• Strong working knowledge of TCP/IP networking and common protocols.

What We Require:

• Extensive security experience (3+ years) in at least one major platform (e.g. AWS, Azure, Windows, OS X, Linux, etc.).
• Proficiency in Python (preferred), PowerShell, or similar.
• Active TS/SCI security clearance or eligibility to obtain a security clearance.

XML job scraping automation by YubHub

In this role, you'll be the first line of defense for protecting Palantir. Your team is responsible for the 24/7 prevention, detection, and investigation of security events and active attacks across our entire infrastructure. Your work will directly impact the success of Palantir's mission as you seek to make it challenging for our adversaries and protect our global network.

Core Responsibilities:

• Build, run, and own infrastructure and automation to detect, contain, and eradicate security threats.
• Develop alerting and detection strategies to identify malicious or anomalous behavior.
• Develop new and novel defensive techniques to identify or counteract changes in adversary techniques and tactics.
• Dissect network, host, memory, and other artifacts originating from multiple operating systems and applications.
• Investigate enterprise-wide operations to uncover sophisticated and undetected threats.
• Partner closely with other members of the Information Security team to lead changes in the company's network defense posture.

What We Value:

• Broad exposure to multiple security subject areas, including a strong background in forensics or threat intelligence.
• Deep exposure in Incident Response or Detection Engineering.
• Desire to further the information security community through substantive contributions (e.g. conference talks, blog posts, public tool development, etc.).
• Strong working knowledge of TCP/IP networking and common protocols.

What We Require:

• Extensive security experience (3+ years) in at least one major platform (e.g. AWS, Azure, Windows, OS X, Linux, etc.).
• Proficiency in Python (preferred), PowerShell, or similar.
• Active TS/SCI security clearance or eligibility to obtain a security clearance.

XML job scraping automation by YubHub