← All roles

Senior Windows Detection Engineer

SentinelOne
Apply on company site
Hybrid (Remote)Full-timePosted 5d ago

About the role

Senior engineer responsible for setting the technical direction of Windows threat detection on the SentinelOne agent, owning default detection content, writing multi-event behavioral detections, and mentoring others while shaping detection strategy.

Responsibilities

  • Research attacker tradecraft including intrusion sets, malware families, red team tooling, and emerging Windows TTPs, translating findings into behavioral detections mapped to MITRE ATT&CK.

Qualifications

  • Significant experience in Detection Engineering, Threat Research, Red Teaming, or Offensive Research, including senior or Staff level
  • Hands-on experience writing behavioral detection rules for EDR, XDR, SIEM or similar platforms
  • Malware analysis experience (static and dynamic) and translating findings into detection logic
  • Expert understanding of modern Windows attack TTPs and Windows telemetry artifacts (process, file, registry, network, etc.)
  • Proven ability to perform rigorous false-positive analysis and tune rules for precision and coverage
  • Experience with data analysis, scripting/hunting queries; proficiency in Python
  • Track record validating detections with adversary emulation or attack simulation (e.g., Atomic Red Team, Caldera)
  • Experience with detection-as-code workflows, writing tests for rules
  • Strong analytical, problem-solving, and communication skills
  • Preferred: Sigma, KQL/SPL, reverse engineering Windows malware, EDR internals knowledge, Windows internals, C/C++, CI/CD tooling familiarity

Skills

Required:Detection engineeringMalware analysisWindows TTPsPythonCommunication
Nice to have:Sigma/KQL/SPLAdversary emulation

Benefits

  • Equity & Rewards: RSUs, ESPP
  • Time Off & Wellbeing: Competitive leave benefits, gender-neutral parental leave
  • Insurance & Financial Security: Medical and insurance benefits, EAP
  • Work Perks & Flexibility: Global home office allowance, internet allowance, LinkedIn Learning license, Social Connect program, food allowance (Bangalore), meal vouchers (Sodexo)
  • Wellness & Lifestyle: Health & wellness benefit
  • Equal opportunity employer with EEO/AA policies and E-Verify for U.S. roles
Last updated Oct 22, 2026. Interested? Apply on the company site.
SentinelOne logo

About SentinelOne

AI-Powered Enterprise Cybersecurity Platform

SentinelOne unifies AI-powered endpoint, cloud, identity, and data protection—enhanced by our Security Data Lake for seamless and efficient cybersecurity.

CybersecurityAI SecurityEndpoint SecurityCloud SecurityAI-SIEMIdentity SecurityEDRXDR
Company profileWebsite

More open roles at SentinelOne