Senior DFIR Lead - Incident Response & Forensics

SentinelOne, Inc.; United States; Remote; USD 108,000 - 130,000; Full time

Benefits offered by this job

RSUs

ESPP

Flexible time off

Home office allowance

Health insurance

Job summary

SentinelOne is seeking a Senior DFIR Analyst to act as technical lead on breach response investigations for our 24x7x365 DFIR team. You will own evidence handling, documentation quality, and customer communications, partnering with an Engagement Manager on scoping and strategy.

You will bring deep threat hunting and forensics expertise across endpoint, network, and cloud environments, mentoring analysts and guiding investigations end-to-end.

Qualifications

• Bachelor’s or Master’s degree in Digital Forensics, Cybersecurity, Computer Science, or related field.
• 4+ years of hands-on experience in digital forensics, incident response, or threat hunting.

Responsibilities

• Serve as technical lead on DFIR engagements, directing analytical focus and coordinating with the Engagement Manager.
• Support case intake by gathering initial technical details and assessing scope.
• Conduct EDR-driven incident response and vendor-agnostic forensic analysis across endpoints, networks, and cloud.
• Develop tactical containment guidance and remediation recommendations for each engagement.
• Acquire and preserve forensic evidence with chain-of-custody procedures and thorough documentation.
• Lead case handovers and mentor Analysts on methodology and best practices.
• Build or improve scripts, tooling, and internal processes to streamline investigations.

Skills

Digital forensics

Incident response

Threat hunting

Lead engagements

Python scripting

Education

Bachelor's/Master's in Digital Forensics, Cybersecurity, CS

Tools

X-Ways Forensics

Axiom

FTK

SentinelOne EDR

Job description

SentinelOne is seeking a Senior DFIR Analyst to act as technical lead on breach response investigations for our 24x7x365 DFIR team. You will own evidence handling, documentation quality, and customer communications, partnering with an Engagement Manager on scoping and strategy.

You will bring deep threat hunting and forensics expertise across endpoint, network, and cloud environments, mentoring analysts and guiding investigations end-to-end.