Senior Windows Detection Engineer
SentinelOne10 days ago
Bengaluru, IndiaSenior
Responsibilities
- Research attacker tradecraft, malware families, red-team tooling, and Windows TTPs and translate findings into MITRE ATT&CK-mapped behavioral detections.
- Design multi-event correlation logic that detects technique-level behavior while resisting evasion and bypasses.
- Own the detection rule lifecycle, including hypothesis development, authoring, validation, false-positive analysis, promotion, and production tuning.
- Analyze telemetry and alert data at scale to measure detection noise and efficacy and improve precision and coverage.
- Define and prioritize the detection backlog based on threat intelligence, customer impact, and ATT&CK coverage gaps.
- Review peer rules and establish standards for detection logic, performance, metadata, testing, and maintainability.
- Write clear rule descriptions, metadata, and test cases for explainable and verifiable detections.
- Partner with threat research, agent and platform teams, and MDR/SOC teams to improve detection content and telemetry capabilities.
- Mentor engineers on attacker tradecraft, detection design, and false-positive analysis.
Requirements
- Significant experience in detection engineering, threat research, red teaming, or offensive research, including leading detection work at a senior or Staff level.
- Deep hands-on experience writing behavioral detection rules for EDR, XDR, SIEM, or similar platforms.
- Hands-on malware analysis experience, including static and dynamic analysis and translating malicious behavior into detection logic.
- Expert knowledge of modern Windows attack TTPs across access, execution, persistence, privilege escalation, credential access, defense evasion, lateral movement, and impact.
- Strong knowledge of Windows telemetry and attacker artifacts, including processes, files, registry, network activity, scheduled tasks, services, and WMI.
- Proven ability to perform rigorous false-positive analysis, baseline benign behavior, quantify noise, and tune rules for coverage and precision.
- Experience using data analysis, scripting, or hunting queries to validate detections against large telemetry datasets; Python proficiency is expected.
- Experience validating detections through adversary emulation or attack simulation such as Atomic Red Team, Caldera, or custom tooling.
- Comfort with version-controlled, code-reviewed detection-as-code workflows and writing rule tests.
- Strong analytical, problem-solving, prioritization, written communication, and verbal communication skills.
- Experience with Sigma, KQL, SPL, or other rule languages is preferred.
- Experience reverse engineering Windows malware for x86/x64 is preferred.
- Understanding of EDR internals and sensor telemetry collection, including the ability to recommend new data sources, is preferred.
- Working knowledge of Windows internals and C/C++ is preferred.
- Familiarity with Jenkins and unit and integration testing for detection content is preferred.
Benefits
- Restricted Stock Units and an Employee Stock Purchase Plan.
- Competitive leave benefits and gender-neutral parental leave.
- Medical and insurance benefits and an Employee Assistance Program.
- Global home office allowance, internet allowance, LinkedIn Learning license, and Social Connect program.
- Food allowance for the Bangalore office and Sodexo meal vouchers.
- Health and wellness benefit.
About SentinelOne
SentinelOne builds an AI-driven cybersecurity platform that provides endpoint protection, detection and response, XDR, cloud, and identity security for enterprises. Its Singularity platform is sold as subscription software and managed services to secure laptops, servers, containers, and cloud workloads with automated detection and remediation. Founded in 2013 and headquartered in Mountain View, California, SentinelOne is a public company listed on the NYSE following its 2021 IPO.