Sr Windows Detection Engineer

SentinelOne; New Delhi; Presencial; INR 2.500.000 - 4.500.000; Tempo integral

Resumo da vaga

SentinelOne, Inc. in India seeks a Senior Windows Detection Engineer to set technical direction for Windows threat detections. You will own default detection content on the Windows agent and write behavioral rules across processes, files, registries, networks, and OS events.

You will mentor engineers, shape detection strategy, and evolve detection capabilities with cross-team collaboration.

Qualificações

• Significant experience in Detection Engineering or Threat Research at senior or staff level.
• Hands-on experience writing behavioral detection rules for EDR/XDR/SIEM platforms.
• Experience in malware analysis (static and dynamic) and translating findings into rules.
• Strong knowledge of Windows attack TTPs and telemetry artifacts.
• Experience with data analysis, scripting, or hunting queries; Python proficiency expected.
• Track record validating detections with adversary emulation or attack simulations.
• Experience in detection-as-code workflows with tests for rules.
• Strong written and verbal communication and prioritization skills.

Responsabilidades

• Research attacker tradecraft and translate findings into precise detections mapped to MITRE ATT&CK.
• Design multi-event correlation logic focusing on technique-level behavior and evasion resistance.
• Own the full rule lifecycle from hypothesis to production tuning.
• Analyze telemetry at scale to measure noise and improve precision.
• Define and prioritize the detection backlog based on threat intel and coverage gaps.
• Review peers' rules for logic and performance and set team standards.
• Write clear rule descriptions, metadata, and test cases for explainability.
• Collaborate with threat research, agent/platform teams, and MDR/SOC for feedback.
• Mentor engineers on attacker tradecraft, detection design, and false-positive analysis.

Conhecimentos

Detection engineering

Threat research

Red teaming

Malware analysis

Windows telemetry

Rule language (Sigma/KQL/SPL)

Python scripting

Adversary emulation

Detection-by-code workflow

Communication & mentoring

Ferramentas

Sigma

KQL

SPL

Descrição da vaga

Job Summary

As a Senior Windows Detection Engineer, you will be tasked with setting the technical direction for how SentinelOne detects threats on the Windows agent. You will own the detection content that ships by default on the SentinelOne Windows agent, writing behavioral rules that correlate process, file, registry, network, and other OS events into high-fidelity detections. As a senior engineer, you will also shape detection strategy, mentor other engineers, and influence how our detection capabilities evolve.

Responsibilities

• Research attacker tradecraft including intrusion sets, malware families, red team tooling, and emerging Windows TTPs, and translate findings into precise, resilient behavioral detections mapped to MITRE ATTCK.
• Design multi-event correlation logic that catches technique-level behavior rather than brittle indicators, with attention to evasion and bypass resistance.
• Own the full rule lifecycle: hypothesis, authoring, validation, false-positive analysis, promotion to default, and ongoing tuning in production.
• Analyze telemetry and alert data at scale to measure rule noise and efficacy, and drive improvements to precision and coverage.
• Define and prioritize the detection backlog based on threat intelligence, customer impact, and coverage gaps across the ATTCK matrix.
• Review peers rules for logic, performance, and metadata quality, and set the standards for detection engineering practices across the team.
• Write clear rule descriptions, metadata, and test cases so every detection is explainable, maintainable, and verifiable.
• Partner with threat research, agent and platform teams, and the MDR/SOC to feed real-world findings back into detection content and to propose improvements to rule capabilities and telemetry.
• Mentor engineers on attacker tradecraft, detection design, and false-positive analysis.

What Skills and Knowledge Will You Bring

• Significant experience in Detection Engineering, Threat Research, Red Teaming, or Offensive Research, including leading detection work at a senior or Staff level.
• Deep, hands-on experience writing behavioral detection rules for EDR, XDR, SIEM, or similar platforms.
• Hands-on experience in malware analysis (static and dynamic), with the ability to analyze malicious behavior, understand attack techniques, and translate findings into effective behavioral detection logic.
• Expert understanding of modern Windows attack TTPs: initial access, execution, persistence, privilege escalation, credential access, defense evasion, lateral movement, and impact, including how real malware and operators behave on Windows.
• Strong working knowledge of Windows telemetry and the artifacts attackers leave behind (process, file, registry, network, scheduled tasks, services, WMI, and similar), and the ability to reason about what is detectable and what is not.
• Proven ability to perform rigorous false-positive analysis: baselining benign behavior, quantifying noise, and tuning rules to balance coverage and precision.
• Experience using data analysis, scripting, or hunting queries to validate detections against large telemetry datasets; proficiency in Python is expected.
• Track record of validating detections with adversary emulation or attack simulation such as Atomic Red Team, Caldera, or custom tooling.
• Comfort working in a version-controlled, code-reviewed detection-as-code workflow, including writing tests for rules.
• Strong analytical and problem-solving skills, with sound judgment on prioritization and tradeoffs, and excellent written and verbal communication.
• Experience with Sigma, KQL/SPL, or other rule languages is preferred.
• Experience in reverse engineering Windows malware (x86/x64) is preferred.
• Understanding of EDR internals and how sensor telemetry is collected, and the ability to recommend new data sources that unlock better detections is preferred.
• Working knowledge of Windows internals and C/C++ to support deeper behavioral research is preferred.
• Familiarity with CI/CD tooling such as Jenkins and with unit and integration testing for detection content is preferred.

Disclaimer: This job posting and Location has been aggregated from external source. Role details, content, and availability are subject to change. Applicants are advised to confirm the latest information directly on the company website before applying.