Senior Detection Engineer

Our Purpose

At SentinelOne, we are driven by a clear purpose: to give the advantage to those who secure our future. As AI reshapes how organizations build, operate, and innovate, the responsibility to protect them becomes more critical than ever. When you join SentinelOne, your work helps protect global enterprises, critical infrastructure, and the technologies shaping tomorrow. If you are motivated by meaningful challenges and want your impact to be real, measurable, and global, you will find purpose here.

About Us

SentinelOne is a company at the intersection of AI and security, pioneering a new operating model for cybersecurity. Our AI-native platform unifies protection across endpoint, cloud, identity, data, and AI systems to deliver autonomous detection and response with clarity and speed. By combining real-time analytics, intelligent automation, and a unified data foundation, we reduce noise, simplify complexity, and empower security teams to focus on what truly matters.

Our teams are builders, problem-solvers, and innovators committed to shaping the future of security. If you are excited to solve hard problems alongside talented, mission-driven people, we invite you to help us build a safer future for humanity.

What Are We Looking For?

• We’re looking for people who are relentlessly curious and committed to continuous learning. AI is reshaping every function across our business, and we enable every team member, regardless of role or level, to build fluency in AI tools and concepts. Those who thrive here actively seek out new solutions, experiment thoughtfully, and apply what they learn to drive better, faster, smarter outcomes.
• As a Senior Detection Engineer, you will be tasked with owning detections end to end, from the first hypothesis to a rule that runs quietly and catches real threats in production. You will craft, validate, and tune detection rules across EDR, XDR, cloud, and network data sources, working closely with research, product management, and data-pipeline teams to prioritize coverage.

What Will You Do?

Primary responsibilities include

Craft, own, and package detection rules for EDR, XDR, cloud, and network data sources.

Build rules that correlate detections across third-party sources and over time.

Turn hunt findings and threat research into detections, or document clearly why a behavior cannot be detected reliably.

Validate every rule against real or lab telemetry before it ships, measuring noise and confirming true positives.

Analyze false positives rigorously, and tune new and existing rules to improve detection accuracy.

Respond promptly to customer escalations and false-positive reports.

Review teammates' pull requests with specific, actionable feedback, and write clear PR descriptions and ticket updates.

Stay current on emerging threats, industry trends, and new technologies, and apply them to improve rule efficacy.

Work with research, product management, and data-pipeline teams to prioritize coverage and plan quarterly roadmaps.

What Skills and Knowledge Will You Bring?

Ideal candidates will have

4 or more years in detection engineering, threat detection, SOC engineering, or a closely related security role.

Experience writing behavioral detection rules for SIEM, EDR, XDR, or similar platforms, using query languages such as S1QL/SDL, Sigma, KQL, or SPL.

Familiarity with building detections across the MITRE ATT&CK matrix, and how adversary techniques map to observable behavior.

Strong log analysis skills across Windows, Linux, and network telemetry, including the ability to separate real findings from logging artifacts.

Strong analytical and problem-solving skills, with a solid grasp of false-positive analysis and root causes such as overly broad string matching.

Proficiency in scripting and programming, with Python preferred, and comfort with Git and pull-request workflows.

Familiarity with detection engineering processes, including prioritizing a research and development backlog, writing unit and integration tests, and working with CI/CD.

Knowledge of cybersecurity frameworks, threat intelligence, and industry best practices.

Clear written communication and a collaborative, team-oriented approach: you document what you tested, what you found, and why you made each call.

Ownership: you drive tickets to a decision, flag blockers early, and respond to stakeholders without being chased.

Experience building and maintaining detections for a cybersecurity software product is preferred.

Experience in a SOC or similar environment where detection products were used and alerts triaged is preferred.

Experience writing YARA or other static detections is preferred.

Experience with cloud, identity, and SaaS logs (AWS, Azure, Okta, Microsoft 365, or similar) is preferred.

Threat research or threat hunting background, including turning hunts into detections, is preferred.

Experience building test automation for detections, such as CI checks that validate rules before merge, is preferred.

Familiarity with detection evaluation frameworks, including MITRE ATT&CK Evaluations, is preferred.

Experience using AI coding assistants to speed up scripting, testing, and tooling, with judgment about checking their output, is preferred.

Why SentinelOne?

AI is redefining how the world operates and rewriting the rules of security in real time, and SentinelOne was built for this moment. From day one, we architected an AI-native platform designed to operate at machine speed, not as an add-on to legacy systems but as the foundation itself. If you want to build where innovation and impact move together, this is that place.

We invest in our Sentinels with comprehensive, competitive benefits designed to support you and your family:

Equity & Rewards

Restricted Stock Units (RSUs)

Employee Stock Purchase Plan (ESPP)

Time Off & Wellbeing

Competitive leave benefits

Gender-neutral parental leave

Insurance & Financial Security

Medical and insurance benefits

Employee Assistance Program (EAP)

Work Perks & Flexibility

Global home office allowance

Internet allowance

LinkedIn Learning license

Social Connect program

Food allowance (Bangalore office)

Meal vouchers (Sodexo)

Wellness & Lifestyle

Health & wellness benefit

SentinelOne is proud to be an Equal Employment Opportunity and Affirmative Action employer. We do not discriminate based upon race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics.

SentinelOne participates in the E-Verify Program for all U.S. based roles.

To learn more about how we use AI in our hiring process, please review our

AI in Hiring Candidate Disclosure

.