← All roles

DFIR Analyst

SentinelOne
Apply on company site
Hybrid (Global (regions))Full-timePosted 1mo ago

About the role

SentinelOne is seeking a DFIR Analyst to conduct incident response, digital forensics, and threat-hunting activities across endpoint, network, cloud, and SaaS environments, with on-call rotation and regional handovers.

Responsibilities

  • Conduct EDR-driven incident response and vendor-agnostic forensic analysis spanning endpoint, network, cloud, and SaaS environments, including ransomware, business email compromise, identity compromise, and other common incident types.
  • Acquire and preserve forensic evidence from endpoint, network, and cloud sources following standard chain-of-custody procedures; support case intake by gathering initial technical details to assess scope.
  • Support malware and memory analysis tasks under the guidance of senior team members.
  • Support incident containment actions and prepare security hardening recommendations; maintain thorough case documentation throughout each investigation.
  • Contribute to customer-facing status updates and formal investigative reports, distilling complex technical findings for stakeholders.
  • Follow standard operating procedures and escalate technical or logistical questions to the assigned Technical Lead or Engagement Manager as needed.
  • Maintain awareness of emerging threats, attacker techniques, and evolving cybersecurity trends; contribute observed attacker techniques and indicators to the team's shared knowledge base.
  • Be responsive to high-pressure triage and analysis during large-scale cybersecurity incidents, maintaining composure; participate in a rotating on-call schedule for weekends and holidays.
  • Support handovers of investigations across regions as needed.

Qualifications

  • Bachelor's or Master's degree in Digital Forensics, Cybersecurity, Computer Science, or a related technical field, or equivalent practical self-study.
  • 2 or more years of hands-on experience in digital forensics, incident response, or threat hunting, ideally in a consulting or services delivery environment.
  • Comfort analyzing Windows environments and forensic artifacts; foundational understanding of forensic methodologies, evidence handling, acquisition techniques, and chain-of-custody procedures.
  • Experience with forensic tools such as X-Ways Forensics, Axiom, and FTK.
  • Experience with EDR/XDR platforms (SentinelOne preferred) and SIEMs.
  • Working knowledge of network protocols and network-based forensic analysis; scripting and automation capabilities.
  • Strong verbal and written communication—comfortable documenting and presenting technical findings clearly and precisely.
  • Ability to perform technical investigations under pressure in high-stakes, time-sensitive situations, while maintaining composure; self-starter with intellectual curiosity and adaptability.
  • Knowledge of Linux and macOS forensic analysis is preferred.
  • Exposure to cloud environments (AWS, Azure, GCP) and memory analysis is preferred.

Skills

Required:Digital forensicsIncident responseEDR/XDR toolingForensic toolsCommunication
Nice to have:Threat huntingScripting/automationCloud familiarity

Benefits

  • Restricted Stock Units (RSUs)
  • Employee Stock Purchase Plan (ESPP)
  • Competitive leave benefits
  • Gender-neutral parental leave
  • Medical and insurance benefits
  • Employee Assistance Program (EAP)
  • Global home office allowance
  • Internet and mobile phone allowance
  • Flexible benefits allowance
Last updated Oct 22, 2026. Interested? Apply on the company site.
SentinelOne logo

About SentinelOne

AI-Powered Enterprise Cybersecurity Platform

SentinelOne unifies AI-powered endpoint, cloud, identity, and data protection—enhanced by our Security Data Lake for seamless and efficient cybersecurity.

CybersecurityAI SecurityEndpoint SecurityCloud SecurityAI-SIEMIdentity SecurityEDRXDR
Company profileWebsite

More open roles at SentinelOne