Senior Detection Engineer
SentinelOne3 hours ago
India (city not specified)Senior
Responsibilities
- Create, own, and package behavioral detection rules across EDR, XDR, cloud, and network data sources.
- Correlate detections across third-party sources and over time.
- Translate threat hunts and research findings into production detections or document detection limitations.
- Validate rules against real or laboratory telemetry, measure noise, and confirm true positives before release.
- Analyze false positives and tune detection rules to improve accuracy.
- Respond to customer escalations and false-positive reports.
- Review pull requests and provide actionable technical feedback and documentation.
- Collaborate with research, product management, and data-pipeline teams on coverage priorities and quarterly roadmaps.
Requirements
- At least 4 years of experience in detection engineering, threat detection, SOC engineering, or a related security role.
- Experience writing behavioral detection rules for SIEM, EDR, XDR, or similar platforms using query languages such as S1QL/SDL, Sigma, KQL, or SPL.
- Familiarity with the MITRE ATT&CK matrix and mapping adversary techniques to observable behavior.
- Strong log analysis skills across Windows, Linux, and network telemetry, including distinguishing findings from logging artifacts.
- Proficiency in scripting and programming, with Python preferred, and comfort with Git and pull-request workflows.
- Experience with detection engineering processes, research and development backlog prioritization, unit and integration testing, and CI/CD workflows.
- Knowledge of cybersecurity frameworks, threat intelligence, and industry best practices.
- Clear written communication, collaborative working style, ownership, and strong analytical and problem-solving skills.
- Preferred qualifications include cybersecurity product detection experience, SOC or alert-triage experience, YARA experience, cloud and SaaS log experience, threat research or hunting experience, detection test automation, familiarity with MITRE ATT&CK Evaluations, and use of AI coding assistants.
Benefits
- Restricted Stock Units and an Employee Stock Purchase Plan.
- Competitive leave benefits and gender-neutral parental leave.
- Medical and insurance benefits, plus an Employee Assistance Program.
- Global home office allowance, internet allowance, LinkedIn Learning license, and Social Connect program.
- Food allowance for the Bangalore office, meal vouchers, and a health and wellness benefit.
About SentinelOne
SentinelOne builds an AI-driven cybersecurity platform that provides endpoint protection, detection and response, XDR, cloud, and identity security for enterprises. Its Singularity platform is sold as subscription software and managed services to secure laptops, servers, containers, and cloud workloads with automated detection and remediation. Founded in 2013 and headquartered in Mountain View, California, SentinelOne is a public company listed on the NYSE following its 2021 IPO.