Senior DFIR Lead - AI-Driven Incident Response & Forensics

SentinelOne, Inc.; United States; On-site; USD 140,000 - 210,000; Full time

Benefits offered by this job

Medical, dental, and vision coverage

Employee assistance program

Gym reimbursement

Unlimited Time Off

Parental Leave 16 weeks

RSU program

401K

Job summary

SentinelOne, Inc. is seeking a Senior DFIR Analyst to lead breach investigations within our 24x7 DFIR team. You will own evidence handling, case documentation, and deliverables, coordinating with the Engagement Manager on scope and strategy.

You’ll apply threat hunting, endpoint, network, and cloud forensics skills to guide remediation, mentor analysts, and develop tooling to accelerate repeatable workflows. This role also involves on-call duties and client communication.

Qualifications

• Bachelor's or Master's in Digital Forensics, Cybersecurity, Computer Science or related field.
• 4+ years of hands-on experience in digital forensics, incident response, or threat hunting.
• Strong experience with EDR/XDR platforms and SIEMs.
• Comfort analyzing Windows, Linux, and macOS environments.
• Experience leading breach response engagements.

Responsibilities

• Serve as technical lead on DFIR engagements, directing analytical focus.
• Own evidence handling, documentation standards, and investigative reports.
• Lead case handovers and mentor Analysts on methodology.
• Develop tactical containment guidance and remediation recommendations.
• Build or improve scripts, tooling, and internal processes for repeatable workflows.

Skills

Network forensics

Threat hunting

EDR/XDR experience

Python scripting

Incident response

Forensic analysis

Education

Bachelor's or Master's in Digital Forensics/Cybersecurity/CS

Tools

X-Ways Forensics

Axiom

FTK

SentinelOne

SIEMs

Job description

SentinelOne, Inc. is seeking a Senior DFIR Analyst to lead breach investigations within our 24x7 DFIR team. You will own evidence handling, case documentation, and deliverables, coordinating with the Engagement Manager on scope and strategy.

You’ll apply threat hunting, endpoint, network, and cloud forensics skills to guide remediation, mentor analysts, and develop tooling to accelerate repeatable workflows. This role also involves on-call duties and client communication.