DFIR Analyst

SentinelOne; United States; On-site; USD 108,000 - 120,000; Full time

Benefits offered by this job

RSUs

ESPP

Flexible time off

Paid holidays and sick time

Medical, dental, and vision coverage

401(k) with company match

Home office allowance

Mobile phone reimbursement

Wellness coaching

Job summary

SentinelOne is seeking a DFIR Analyst to serve as the technical lead on breach response investigations within our 24x7x365 DFIR team. You will own evidence handling, case documentation, and deliverables, collaborating with the Engagement Manager on scoping, strategy, and client communications.

The role requires 4+ years of hands-on digital forensics, incident response, or threat hunting, with strong expertise in Windows/Linux/macOS, X-Ways Forensics, Axiom, FTK, and SentinelOne/E DR platforms.

Qualifications

• Lead or technical contributor on breach response engagements.
• Comfort analyzing Windows, Linux, and macOS environments.
• Expert-level experience with forensic tools (X-Ways, Axiom, FTK).
• Strong experience with EDR/XDR platforms and SIEMs.
• Knowledge of network protocols and network forensic analysis.
• Cloud incident response across AWS/Azure/GCP.
• Malware analysis and reverse engineering basics.
• Endpoint-based threat hunting experience.
• Scripting ability (Python).
• Clear, evidence-backed reporting and written findings.
• Ability to communicate findings to technical and non-technical stakeholders.
• Self-starter with curiosity and adaptability.

Responsibilities

• Serve as technical lead on DFIR engagements and align work with client expectations.
• Assist with case intake and scoping.
• Conduct incident response and forensic analysis across endpoints, network, cloud, and SaaS.
• Provide containment guidance and remediation recommendations.
• Contribute techniques and indicators to team knowledge base.
• Preserve forensic evidence with proper chain of custody and thorough documentation.
• Prepare interim updates and final investigative reports.
• Lead case handovers and mentor junior analysts.
• Improve tooling and processes with automation and AI-assisted approaches.
• Escalate scope or resource concerns to the Engagement Manager.

Skills

Technical leadership

Cross-platform analysis

Forensic tools

EDR/XDR & SIEM

Network forensics

Cloud forensics

Malware analysis

Threat hunting

Python scripting

Reporting/written communication

Stakeholder communication

Self-motivation

Education

Bachelor's or Master's in Digital Forensics, Cybersecurity, CS

Tools

X-Ways Forensics

Axiom

FTK

SentinelOne

SIEMs

Job description

Our Purpose

At SentinelOne, we are driven by a clear purpose: to give the advantage to those who secure our future. As AI reshapes how organizations build, operate, and innovate, the responsibility to protect them becomes more critical than ever. When you join SentinelOne, your work helps protect global enterprises, critical infrastructure, and the technologies shaping tomorrow. If you are motivated by meaningful challenges and want your impact to be real, measurable, and global, you will find purpose here.

About Us

SentinelOne is a company at the intersection of AI and security, pioneering a new operating model for cybersecurity. Our AI-native platform unifies protection across endpoint, cloud, identity, data, and AI systems to deliver autonomous detection and response with clarity and speed. By combining real-time analytics, intelligent automation, and a unified data foundation, we reduce noise, simplify complexity, and empower security teams to focus on what truly matters.

Our teams are builders, problem-solvers, and innovators committed to shaping the future of security. If you are excited to solve hard problems alongside talented, mission-driven people, we invite you to help us build a safer future for humanity.

What Are We Looking For?

We’re looking for people who are relentlessly curious and committed to continuous learning. AI is reshaping every function across our business, and we enable every team member, regardless of role or level, to build fluency in AI tools and concepts. Those who thrive here actively seek out new solutions, experiment thoughtfully, and apply what they learn to drive better, faster, smarter outcomes.

As a DFIR Analyst, you will be tasked with serving as technical lead on small to medium-sized breach response investigations for SentinelOne's 24x7x365, follow-the-sun DFIR team. You'll own case-level evidence and documentation quality end-to-end, partnering closely with an Engagement Manager on scoping, case strategy, and customer communications, and bringing strong, well-rounded technical depth across threat hunting and endpoint, network, and cloud forensics.

What Will You Do?

Primary responsibilities include:

• Serve as technical lead on DFIR engagements, directing analytical focus and partnering with the Engagement Manager to align technical work with scope and client expectations.
• Support case intake by gathering initial technical details and assessing scope.
• Conduct EDR-driven incident response and vendor-agnostic advanced forensic analysis spanning endpoint, network, cloud, and SaaS environments (including ransomware, business email compromise, identity compromise, and other common incident types).
• Develop tactical containment guidance and remediation recommendations tailored to each engagement's specific attack pattern.
• Contribute observed attacker techniques and indicators to the team's shared knowledge base.
• Acquire and preserve forensic evidence from endpoint, network, and cloud sources following standard chain-of-custody procedures, with clear, thorough case documentation throughout each investigation.
• Support the preparation and delivery of interim status updates and deliverables.
• Own evidence handling, documentation standards, and the accuracy and quality of formal investigative reports for assigned engagements, ensuring findings are defensible, well-supported, and peer-reviewed before reaching a customer, breach counsel, or other stakeholder.
• Lead case handovers for assigned engagements, ensuring a complete, clear transfer of status when work moves across regions.
• Mentor Analysts on technical methodology, evidence handling, and investigative best practices.
• Manage triage and analysis in high-pressure, large-scale incidents, maintaining composure and clear decision-making.
• Build or improve scripts, tooling, and internal processes — including AI-assisted approaches where useful — to streamline recurring forensic, analysis, and reporting workflows.
• Escalate scope, resourcing, or customer relationship concerns to the EM promptly, while owning technical escalations directly.
• Track hours for investigations accurately and in a timely fashion.
• Participate in a rotating on-call schedule for weekends and holidays, to support active incident response.
• Maintain awareness of emerging threats, attacker techniques, and evolving cybersecurity trends.

What Skills and Knowledge Will You Bring?

Ideal candidates will have:

• Bachelor's or Master's degree in Digital Forensics, Cybersecurity, Computer Science, or a related technical field (or equivalent practical self-study).
• 4+ years of hands-on experience in digital forensics, incident response, or threat hunting, ideally in a consulting or services delivery environment.
• Demonstrated experience serving as a lead or technical contributor on complex breach response engagements, capable of working independently with minimal guidance.
• Comfort analyzing Windows, Linux, and macOS environments.
• Expert-level experience with forensic investigative tools such as X-Ways Forensics, Axiom, and FTK.
• Strong experience with EDR/XDR platforms (SentinelOne preferred) and SIEMs.
• Strong understanding of network protocols, network security architecture, and network-based forensic analysis.
• Working knowledge of cloud incident response methodology across at least one major provider (AWS, Azure, or GCP).
• Experience conducting dynamic malware analysis and solid understanding of the reverse engineering process.
• Experience conducting endpoint-based threat hunting (compromise assessments).
• Scripting ability (Python preferred), with experience automating investigative or analysis tasks.
• Demonstrated ability to write clear, evidence-backed findings and reason through ambiguous or incomplete data in writing.
• Comfort communicating findings to a range of stakeholders, including customer technical teams, executives, and legal counsel.
• An evident self-starter with intellectual curiosity and the ability to adapt to change.

Why SentinelOne?

AI is redefining how the world operates and rewriting the rules of security in real time, and SentinelOne was built for this moment. From day one, we architected an AI-native platform designed to operate at machine speed, not as an add-on to legacy systems but as the foundation itself. If you want to build where innovation and impact move together, this is that place.

We invest in our Sentinels with comprehensive, competitive benefits designed to support you and your family:

Equity & Rewards

• Restricted Stock Units (RSUs)
• Employee Stock Purchase Plan (ESPP)

Time Off & Wellbeing

• Flexible time off
• Paid company holidays and paid sick time
• Gender-neutral parental leave
• Grandparent leave

Insurance & Financial Security

• Medical, dental, and vision coverage
• 401(k) retirement plan with company match
• Life and disability insurance
• Health and dependent care FSA
• Voluntary benefits (hospital, accident, critical illness)
• Employee Assistance Program (EAP)
• ARAG pre-paid legal
• Nationwide pet insurance
• Cancer Care program
• Global business travel medical insurance

Work Perks & Flexibility

• Home office allowance
• Mobile phone reimbursement

Wellness & Lifestyle

• Wellness coach
• Wellness/gym reimbursement
• Fertility coverage
• Adoption & surrogacy reimbursement

This U.S. role has a base pay range that will vary based on the location of the candidate. For some locations, a different pay range may apply. If so, this range will be provided to you during the recruiting process.

Base Salary Range

$108,000—$120,000 USD

SentinelOne is proud to be an Equal Employment Opportunity and Affa... SentinelOne participates in the E-Verify Program for all U.S. based roles.