Senior Windows Detection Engineer

sentinellabs; India; On-site; INR 400,000 - 900,000; Full time

Job summary

SentinelOne is hiring a Senior Windows Detection Engineer in India to shape the detection content of the Windows agent. You will craft behavioral rules, correlate OS events, and drive detection strategy with mentorship across the team.

You'll own the rule lifecycle from hypothesis to production tuning, analyze telemetry at scale, and collaborate with threat research and platform teams to improve coverage against MITRE ATT&CK techniques.

Qualifications

• Significant experience in Detection Engineering, Threat Research, Red Teaming, or Offensive Research at a senior level.
• Hands-on experience writing behavioral detection rules for EDR, XDR, SIEM or similar platforms.
• Malware analysis experience (static and dynamic) and translating findings into detections.
• Strong knowledge of Windows attack TTPs and telemetry artifacts.
• Proficiency in Python for data analysis and validation.
• Experience validating detections with adversary emulation such as Atomic Red Team.

Responsibilities

• Research attacker tradecraft and translate findings into precise detections mapped to MITRE ATT&CK.
• Design multi-event correlation logic focusing on technique-level behavior and evasion resistance.
• Own the full rule lifecycle from hypothesis to production tuning.
• Analyze telemetry at scale to measure rule noise and improve precision and coverage.
• Define and prioritize the detection backlog based on threat intel and coverage gaps.
• Review peers' rules for logic, performance, and metadata quality.
• Write clear rule descriptions, metadata, and test cases for maintainability.
• Collaborate with threat research, agent/platform teams, and MDR/SOC to improve telemetry.
• Mentor engineers on attacker tradecraft and detection design.

Skills

Detection Engineering

Threat Research

Red Teaming

Offensive Research

Behavioral detection rules

Python

Tools

EDR

XDR

SIEM

Python

Job description

Our Purpose

At SentinelOne, we are driven by a clear purpose: to give the advantage to those who secure our future. As AI reshapes how organizations build, operate, and innovate, the responsibility to protect them becomes more critical than ever. When you join SentinelOne, your work helps protect global enterprises, critical infrastructure, and the technologies shaping tomorrow. If you are motivated by meaningful challenges and want your impact to be real, measurable, and global, you will find purpose here.

About Us

SentinelOne is a company at the intersection of AI and security, pioneering a new operating model for cybersecurity. Our AI-native platform unifies protection across endpoint, cloud, identity, data, and AI systems to deliver autonomous detection and response with clarity and speed. By combining real-time analytics, intelligent automation, and a unified data foundation, we reduce noise, simplify complexity, and empower security teams to focus on what truly matters.

Our teams are builders, problem-solvers, and innovators committed to shaping the future of security. If you are excited to solve hard problems alongside talented, mission-driven people, we invite you to help us build a safer future for humanity.

What Are We Looking For?

We're looking for people who are relentlessly curious and committed to continuous learning. AI is reshaping every function across our business, and we enable every team member, regardless of role or level, to build fluency in AI tools and concepts. Those who thrive here actively seek out new solutions, experiment thoughtfully, and apply what they learn to drive better, faster, smarter outcomes.

As a Senior Windows Detection Engineer, you will be tasked with setting the technical direction for how SentinelOne detects threats on the Windows agent. You will own the detection content that ships by default on the SentinelOne Windows agent, writing behavioral rules that correlate process, file, registry, network, and other OS events into high-fidelity detections. As a senior engineer, you will also shape detection strategy, mentor other engineers, and influence how our detection capabilities evolve.

What Will You Do?

Primary responsibilities include:

• Research attacker tradecraft including intrusion sets, malware families, red team tooling, and emerging Windows TTPs, and translate findings into precise, resilient behavioral detections mapped to MITRE ATT&CK.
• Design multi-event correlation logic that catches technique-level behavior rather than brittle indicators, with attention to evasion and bypass resistance.
• Own the full rule lifecycle: hypothesis, authoring, validation, false-positive analysis, promotion to default, and ongoing tuning in production.
• Analyze telemetry and alert data at scale to measure rule noise and efficacy, and drive improvements to precision and coverage.
• Define and prioritize the detection backlog based on threat intelligence, customer impact, and coverage gaps across the ATT&CK matrix.
• Review peers' rules for logic, performance, and metadata quality, and set the standards for detection engineering practices across the team.
• Write clear rule descriptions, metadata, and test cases so every detection is explainable, maintainable, and verifiable.
• Partner with threat research, agent and platform teams, and the MDR/SOC to feed real-world findings back into detection content and to propose improvements to rule capabilities and telemetry.
• Mentor engineers on attacker tradecraft, detection design, and false-positive analysis.

What Skills and Knowledge Will You Bring?

Ideal candidates will have:

• Significant experience in Detection Engineering, Threat Research, Red Teaming, or Offensive Research, including leading detection work at a senior or Staff level.
• Deep, hands-on experience writing behavioral detection rules for EDR, XDR, SIEM, or similar platforms.
• Hands-on experience in malware analysis (static and dynamic), with the ability to analyze malicious behavior, understand attack techniques, and translate findings into effective behavioral detection logic.
• Expert understanding of modern Windows attack TTPs: initial access, execution, persistence, privilege escalation, credential access, defense evasion, lateral movement, and impact, including how real malware and operators behave on Windows.
• Strong working knowledge of Windows telemetry and the artifacts attackers leave behind (process, file, registry, network, scheduled tasks, services, WMI, and similar), and the ability to reason about what is detectable and what is not.
• Proven ability to perform rigorous false-positive analysis: baselining benign behavior, quantifying noise, and tuning rules to balance coverage and precision.
• Experience using data analysis, scripting, or hunting queries to validate detections against large telemetry datasets; proficiency in Python is expected.
• Track record of validating detections with adversary emulation or attack simulation such as Atomic Red