As an Information Security Engineer, you'll enhance the security of Windows and Active Directory, reducing attack surfaces and developing detection tools for advanced threats.
A World-Changing Company
Palantir builds the world’s leading software for data-driven decisions and operations. By bringing the right data to the people who need it, our platforms empower our partners to develop lifesaving drugs, forecast supply chain disruptions, locate missing children, and more.
We're looking for someone who has spent years thinking adversarially about Windows and Active Directory — not just operating them, but understanding every layer of how they can be abused, detected, and hardened. If you've written detections for DCSync, built hunting pipelines around Kerberos ticket anomalies, or reverse-engineered a novel persistence mechanism in a Windows kernel driver, this is the team you want to be on.
As an Information Security Engineer focused on Windows and Active Directory, you'll own the security of Palantir's global Windows infrastructure. Your team runs 24/7 prevention, detection, and investigation of security events across our entire environment. The adversaries we face are sophisticated. We need someone who is more so.
As an Information Security Engineer focused on Windows and Active Directory, you'll own the security of Palantir's global Windows infrastructure. Your team runs 24/7 prevention, detection, and investigation of security events across our entire environment. The adversaries we face are sophisticated. We need someone who is more so.
Core Responsibilities
- Own the security posture of Palantir's Windows and Active Directory estate — hardening, configuration standards, and ongoing validation that those standards hold.
- Reduce attack surface across AD: audit and remediate misconfigurations, legacy protocol exposure, excessive privilege, Kerberos delegation abuse, and tier model violations.
- Evaluate, deploy, and own the configuration of defensive tooling across the Windows environment: EDR, PAM, identity threat detection, and endpoint hardening controls.
- Build and maintain automation for security operations across Windows infrastructure — patching pipelines, configuration drift monitoring, access reviews, and credential hygiene.
- Partner with Identity and Infrastructure teams to drive architectural improvements: tiered administration, Protected Users, LAPS, Credential Guard, and authentication policy silos.
- Translate findings from assessments and red team exercises into durable fixes — configuration changes, architectural improvements, and policy updates that reduce recurrence.
What We're Looking For
- Deep, working knowledge of AD architecture: sites and services, replication, trust relationships, delegation models, and the LDAP schema.
- Hands-on experience investigating and detecting AD attacks across the full kill chain — from initial enumeration through domain dominance.
- Familiarity with attack tooling (BloodHound, Impacket, Rubeus, Mimikatz, CrackMapExec) and, critically, what they leave behind.
- Experience hardening AD environments: tiered administration, Protected Users, LAPS, Credential Guard, PAM trusts, and authentication policy silos.
- Thorough understanding of Windows security architecture: access tokens, privilege model, integrity levels, LSASS and credential storage, SAM, and the Security Reference Monitor.
- Ability to read and interpret Windows kernel structures, driver behavior, and undocumented APIs when necessary.
- Proficiency with low-level analysis tools: WinDbg, Process Monitor, Process Hacker, Volatility, and x64dbg.
- Experience with ETW-based telemetry pipelines and building detections on top of raw Windows event data.
- Proven track record writing high-fidelity detection logic, not just tuning vendor signatures.
- Experience leading complex incident response investigations, including those involving nation-state or sophisticated criminal actors.
- Strong forensic fundamentals across disk, memory, and network artifacts on Windows systems.
Active Directory
Windows Internals
Detection & Response
What We Value
- Experience with Entra ID (Azure AD), hybrid identity architectures, and cloud-based attack paths that pivot through on-prem AD.
- Prior work in adversary simulation, red teaming, or offensive security research — especially against AD targets.
- Public contributions: conference talks (BlueHat, BSides, SANS, etc.), blog posts, or open-source tooling.
What We Require
- 5+ years of hands-on security experience, with the majority focused on Windows environments and Active Directory.
- Proficiency in Python or PowerShell for detection development, automation, and forensic tooling.
- Active TS/SCI security clearance, or eligibility and willingness to obtain one.
- A portfolio of real work: detections you've written, research you've published, tools you've built, or incidents you've led.
Salary
The estimated salary range for this position is estimated to be $145,000 - $200,000/year. Total compensation for this position may also include Restricted Stock units, sign-on bonus and other potential future incentives. Further note that total compensation for this position will be determined by each individual’s relevant qualifications, work experience, skills, and other factors. This estimate excludes the value of any potential sign-on bonus; the value of any benefits offered; and the potential future value of any long-term incentives.
Our benefits aim to promote health and wellbeing across all areas of Palantirians’ lives. We work to continuously improve our offerings and listen to our community as we design and update them. The list below details our available benefits and some of the perks that can be enjoyed as an employee of Palantir Technologies.
Benefits
• Employees (and their eligible dependents) can enroll in medical, dental, and vision insurance as well as voluntary life insurance
• Employees are automatically covered by Palantir’s basic life, AD&D and disability insurance
• Commuter benefits
• Take what you need paid time off, not accrual based
• 2 weeks paid time off built into the end of each year (subject to team and business needs)
• 10 paid holidays throughout the calendar year
• Supportive leave of absence program including time off for military service and medical events
• Paid leave for new parents and subsidized back-up care for all parents
• Fertility and family building benefits including but not limited to adoption, surrogacy, and preservation
• Stipend to help with expenses that come with a new child
• Employees can enroll in Palantir’s 401k plan
Life at Palantir
We want every Palantirian to achieve their best outcomes, that’s why we celebrate individuals’ strengths, skills, and interests, from your first interview to your longterm growth, rather than rely on traditional career ladders. Paying attention to the needs of our community enables us to optimize our opportunities to grow and helps ensure many pathways to success at Palantir. Promoting health and well-being across all areas of Palantirians’ lives is just one of the ways we’re investing in our community. Learn more at Life at Palantir and note that our offerings may vary by region.
In keeping consistent with Palantir’s values and culture, we believe employees are “better together” and in-person work affords the opportunity for more creative outcomes. Therefore, we encourage employees to work from our offices to foster connectivity and innovation. Many teams do offer hybrid options (WFH a day or two a week), allowing our employees to strike the right trade-off for their personal productivity. Based on business need, there are a few roles that allow for “Remote” work on an exceptional basis. If you are applying for one of these roles, you must work from the state in which you are employed. If the posting is specified as Onsite, you are required to work from an office.
If you want to empower the world's most important institutions, you belong here. Palantir values excellence regardless of background. We are proud to be an Equal Opportunity Employer for all, including but not limited to Veterans and those with disabilities. Palantir is committed to making the application and hiring process accessible to everyone and will provide a reasonable accommodation for those living with a disability. If you need an accommodation for the application or hiring process, please reach out and let us know how we can help.
Please note that you will never be asked to submit a payment or share financial information to participate in our interview process. If you suspect that you've been contacted by a scammer, we recommend you cease all communication with the individual and consider reporting them to the relevant authorities, such as the US FBI Internet Crime Complaint Center (IC3).
If you would like to understand more about how your personal data will be processed by Palantir, please see our Privacy Policy.
If you would like to understand more about how your personal data will be processed by Palantir, please see our Privacy Policy.
Similar Jobs at Palantir Technologies
Artificial Intelligence • Software
Frontend engineer building defense-focused applications that integrate Palantir Foundry and AIP with backend services and modern web stacks. Own and deliver user-facing features, work closely with customers and deployed engineers, contribute to shared libraries and tooling, mentor teammates, and iterate rapidly in autonomous, high-ownership teams. Must be adaptable and willing to obtain U.S. security clearance.
Top Skills:
AipConjureFoundryJavaScriptMaplibreOsdkReactReduxThree.Js
Artificial Intelligence • Software
Build and maintain cross-application frontend frameworks enabling real-time communication between Palantir apps. Work with core web APIs (Broadcast Channels, Service Workers, Local Storage) and Electron (IPC) to design ergonomic, portable APIs and UX. Collaborate across teams to integrate frameworks, develop Electron app features, and ensure performance and extensibility.
Top Skills:
Broadcast ChannelsCircleCIElectronGitGradleIpc ApiJavaScriptLocal StorageReactService WorkersTypescriptWebpack
Artificial Intelligence • Software
Support legal and sales teams across the contracting lifecycle: draft, process, execute and track agreements, coordinate cross-functional reviews, manage onboarding forms, maintain records and metrics, and lead business-specific projects to scale deal execution and improve contracting processes.
Top Skills:
Contract Lifecycle Management ToolingMS Office
What you need to know about the NYC Tech Scene
As the undisputed financial capital of the world, New York City is an epicenter of startup funding activity. The city has a thriving fintech scene and is a major player in verticals ranging from AI to biotech, cybersecurity and digital media. It also has universities like NYU, Columbia and Cornell Tech attracting students and researchers from across the globe, providing the ecosystem with a constant influx of world-class talent. And its East Coast location and three international airports make it a perfect spot for European companies establishing a foothold in the United States.
Key Facts About NYC Tech
- Number of Tech Workers: 549,200; 6% of overall workforce (2024 CompTIA survey)
- Major Tech Employers: Capgemini, Bloomberg, IBM, Spotify
- Key Industries: Artificial intelligence, Fintech
- Funding Landscape: $25.5 billion in venture capital funding in 2024 (Pitchbook)
- Notable Investors: Greycroft, Thrive Capital, Union Square Ventures, FirstMark Capital, Tiger Global Management, Tribeca Venture Partners, Insight Partners, Two Sigma Ventures
- Research Centers and Universities: Columbia University, New York University, Fordham University, CUNY, AI Now Institute, Flatiron Institute, C.N. Yang Institute for Theoretical Physics, NASA Space Radiation Laboratory
