SentinelOne EDR Investigator — Incident Response Pro

VaporVM; Dubai; On-site; AED 240,000 - 400,000; Full time

Job summary

VaporVM seeks an experienced EDR Expert to monitor, investigate, and analyze SentinelOne alerts, distinguishing false positives from genuine incidents. You will support timely incident response and collaborate across teams to improve containment and remediation.

The role focuses on reviewing endpoint telemetry, processing trees, and IOCs, with emphasis on MITRE ATT&CK tactics and techniques. Strong analytical skills are essential.

Qualifications

• 3–5+ years in EDR, SOC, cybersecurity operations or incident response.
• Hands-on SentinelOne experience is mandatory.
• Strong understanding of endpoint security, malware analysis and investigations.
• Experience analyzing process trees, endpoint telemetry and IOCs.
• Familiarity with Windows and Linux endpoint security and MITRE ATT&CK.

Responsibilities

• Review SentinelOne EDR alerts to classify false positives vs incidents.
• Investigate endpoint alerts, suspicious activity, malware behavior and IOCs.
• Analyze telemetry, process trees and detection data for root causes.
• Validate incidents, determine severity and impact; escalate when needed.
• Correlate alerts with SIEM data to identify attack patterns.
• Document findings and remediation recommendations; maintain records.
• Tune alerts and policies to reduce recurring false positives.
• Support containment, remediation and eradication activities.
• Prepare regular reports on EDR alerts and incidents.
• Stay updated on new endpoint threats and MITRE techniques.

Skills

EDR

SOC

Incident Response

SentinelOne

MITRE ATT&CK

Windows security

Linux security

Endpoint telemetry

IOC analysis

Threat hunting

Tools

Splunk

Microsoft Sentinel

QRadar

Job description

VaporVM seeks an experienced EDR Expert to monitor, investigate, and analyze SentinelOne alerts, distinguishing false positives from genuine incidents. You will support timely incident response and collaborate across teams to improve containment and remediation.

The role focuses on reviewing endpoint telemetry, processing trees, and IOCs, with emphasis on MITRE ATT&CK tactics and techniques. Strong analytical skills are essential.