Ingeniero de Detección

SentinelOne, Inc.; United States; Remote; USD 110,000 - 170,000; Full time

Job summary

SentinelOne, Inc. is seeking a detection-focused engineer to translate attacker techniques into production detection rules. You will measure false positives and own the tuning process to keep detections trustworthy for on-call teams.

You will hunt for gaps where current detections miss malicious activity and improve coverage. Candidates should understand telemetry-based attack patterns, be proficient with query languages and scripting, and be willing to retire rules that no longer perform.

Qualifications

• Knows what attacks look like in telemetry.
• Experience with queries and scripting languages.
• Ability to delete rules that no longer earn their place.

Responsibilities

• Translate attacker behaviour into production-ready detections.
• Measure false positives and own the results.
• Hunt for detections that current rules miss.

Skills

Threat detection

Telemetry analysis

Query languages

Scripting

Detection engineering

Tools

Sigma rules

Job description

You translate known attacker techniques into detection rules that work against real production data. The difficulty is not writing a rule that fires on a test case; it is writing one that still identifies the technique months later while producing few enough false positives that the on-call team can trust it. You also run threat hunts to find activity that current detections would have missed.

What you will do:

• Build detections from real attacker behaviour
• Measure each rule's false positive rate and own it
• Hunt for what current detections would have missed

What they ask for:

• Knows what attacks look like in telemetry, not just in theory
• Query languages and a scripting language
• Willing to delete your own rules when they stop earning their place

Nice to have:

• Purple team experience
• Sigma rules
• Incident response background