Global DFIR Analyst — 24/7 Incident Response

SentinelOne; Poland; On-site; PLN 120,000 - 180,000; Full time

Benefits offered by this job

RSUs

ESPP

Competitive leave benefits

Gender-neutral parental leave

Medical and insurance benefits

Pension scheme

Global home office allowance

Mobile phone allowance

Wellness benefit

Job summary

SentinelOne is seeking a DFIR Analyst to deliver rapid breach response for global enterprises, conducting hands-on forensic analysis, threat hunting, and investigations across endpoint, network, and cloud environments on a follow-the-sun model.

The role emphasizes evidence-backed conclusions, thorough documentation, and the ability to distill findings for stakeholders, with weekend on-call rotation and opportunities to contribute to the knowledge base.

Qualifications

• Bachelor's or master's in Digital Forensics, Cybersecurity, Computer Science, or related field, or equivalent practical self-study.
• 2+ years hands-on experience in digital forensics, incident response, or threat hunting.
• Experience with Windows forensic artifacts and chain-of-custody procedures.
• Familiarity with memory analysis and cloud environments (AWS/Azure/GCP) is preferred.
• Certifications such as GCFE/GCFA/GREM/CFCE/EnCE are a plus.

Responsibilities

• Conduct EDR-driven incident response and forensic analysis across endpoint, network, cloud, and SaaS environments.
• Support malware and memory analysis tasks.
• Collect and preserve forensic evidence following chain-of-custody procedures.
• Document case intake, scope, containment actions and hardening recommendations.
• Maintain thorough case documentation and conduct clear investigative reporting.

Skills

Scripting and automation

Stress under pressure

Strong communication

Evidence-based analysis

Team collaboration

Education

Bachelor's or Master's in Digital Forensics/Cybersecurity/CS

Tools

X-Ways Forensics

Axiom

FTK

EDR/XDR platforms

SIEMs

Job description

SentinelOne is seeking a DFIR Analyst to deliver rapid breach response for global enterprises, conducting hands-on forensic analysis, threat hunting, and investigations across endpoint, network, and cloud environments on a follow-the-sun model.

The role emphasizes evidence-backed conclusions, thorough documentation, and the ability to distill findings for stakeholders, with weekend on-call rotation and opportunities to contribute to the knowledge base.