Arquitecto de Detección y Caza de Amenazas

SentinelOne, Inc.; United States; Remote; USD 110,000 - 170,000; Full time

Job summary

SentinelOne, Inc. is seeking a detection-focused engineer to translate attacker techniques into production detection rules. You will measure false positives and own the tuning process to keep detections trustworthy for on-call teams.

You will hunt for gaps where current detections miss malicious activity and improve coverage. Candidates should understand telemetry-based attack patterns, be proficient with query languages and scripting, and be willing to retire rules that no longer perform.

Qualifications

• Knows what attacks look like in telemetry.
• Experience with queries and scripting languages.
• Ability to delete rules that no longer earn their place.

Responsibilities

• Translate attacker behaviour into production-ready detections.
• Measure false positives and own the results.
• Hunt for detections that current rules miss.

Skills

Threat detection

Telemetry analysis

Query languages

Scripting

Detection engineering

Tools

Sigma rules

Job description

SentinelOne, Inc. is seeking a detection-focused engineer to translate attacker techniques into production detection rules. You will measure false positives and own the tuning process to keep detections trustworthy for on-call teams.

You will hunt for gaps where current detections miss malicious activity and improve coverage. Candidates should understand telemetry-based attack patterns, be proficient with query languages and scripting, and be willing to retire rules that no longer perform.