← All roles

DFIR Analyst

SentinelOne· Security / Digital Forensics and Incident Response
Apply on company site
RemoteFull-timePosted 1mo ago

About the role

SentinelOne is seeking a DFIR Analyst to conduct incident response, forensic analysis, and support for ransomware, business email compromise, identity compromise, and other incidents across endpoint, network, cloud, and SaaS environments.

Responsibilities

  • Conduct EDR-driven incident response and vendor-agnostic forensic analysis spanning endpoint, network, cloud, and SaaS environments, including ransomware, business email compromise, identity compromise, and other common incident types.
  • Acquire and preserve forensic evidence from endpoint, network, and cloud sources following standard chain-of-custody procedures; support case intake by gathering initial technical details to assess scope.
  • Support malware and memory analysis tasks under the guidance of senior team members.
  • Support incident containment actions and prepare security hardening recommendations; maintain thorough case documentation throughout each investigation.
  • Contribute to customer-facing status updates and formal investigative reports, distilling complex technical findings for stakeholders.
  • Follow standard operating procedures and escalate technical or logistical questions to the assigned Technical Lead or Engagement Manager as needed.
  • Maintain awareness of emerging threats, attacker techniques, and evolving cybersecurity trends; contribute observed attacker techniques and indicators to the team's shared knowledge base.
  • Be responsive to high-pressure triage and analysis during large-scale cybersecurity incidents, maintaining composure; participate in a rotating on-call schedule for weekends and holidays.
  • Support handovers of investigations across regions as needed.

Qualifications

  • Bachelor's or Master's degree in Digital Forensics, Cybersecurity, Computer Science, or a related technical field, or equivalent practical self-study.
  • 2 or more years of hands-on experience in digital forensics, incident response, or threat hunting, ideally in a consulting or services delivery environment.
  • Comfort analyzing Windows environments and forensic artifacts; foundational understanding of forensic methodologies, evidence handling, acquisition techniques, and chain-of-custody procedures.

Skills

Required:EDR/Forensic analysisForensic toolingEDR/XDR platformsNetworkingCommunication
Nice to have:Scripting/AutomationCloud platforms

Benefits

  • Equity & Rewards: Restricted Stock Units (RSUs), Employee Stock Purchase Plan (ESPP)
  • Time Off & Wellbeing: Competitive leave benefits, Gender-neutral parental leave
  • Insurance & Financial Security: Medical and insurance benefits, Employee Assistance Program (EAP)
  • Work Perks & Flexibility: Global home office allowance, Internet and mobile phone allowance, Flexible benefits allowance
Last updated Oct 22, 2026. Interested? Apply on the company site.
SentinelOne logo

About SentinelOne

AI-Powered Enterprise Cybersecurity Platform

SentinelOne unifies AI-powered endpoint, cloud, identity, and data protection—enhanced by our Security Data Lake for seamless and efficient cybersecurity.

CybersecurityAI SecurityEndpoint SecurityCloud SecurityAI-SIEMIdentity SecurityEDRXDR
Company profileWebsite

More open roles at SentinelOne