Senior DFIR Lead — Incident Response & Forensics

SentinelOne; United States; On-site; USD 108,000 - 130,000; Full time

Benefits offered by this job

Restricted Stock Units (RSUs)

Employee Stock Purchase Plan (ESPP)

Flexible time off

Paid holidays and sick time

Parental leave

Job summary

SentinelOne is seeking a Senior DFIR Analyst to serve as the technical lead on breach response investigations for our 24x7x365 DFIR team. You will own evidence handling, documentation quality, and deliverables while coordinating with an Engagement Manager on scoping and customer communications.

You will apply depth in endpoint, network, and cloud forensics, threat hunting, malware analysis, and scripting (Python) to streamline investigations and reporting.

Qualifications

• Bachelor’s or Master’s degree in Digital Forensics, Cybersecurity, Computer Science, or related field (or equivalent practical self‑study).
• 4+ years of hands‑on experience in digital forensics, incident response, or threat hunting, ideally in a consulting/services context.
• Ability to lead complex breach response engagements and work independently.

Responsibilities

• Serve as technical lead on DFIR engagements, directing analytical focus and aligning work with scope.
• Gather initial technical details and assess engagement scope during intake.
• Conduct EDR-driven incident response and cloud/network/endpoint forensics across environments (including ransomware and credential breaches).
• Develop containment guidance and remediation tailored to each engagement’s attack pattern.
• Contribute attacker techniques to the knowledge base and ensure evidence is well-documented per standards.
• Preserve forensic evidence with chain-of-custody procedures and produce defensible reports.

Skills

Lead on breach investigations

EDR/XDR experience

Python scripting

Technical writing

Stakeholder communication

Education

Bachelor's or Master’s in Digital Forensics

Tools

X-Ways Forensics

Axiom

FTK

SentinelOne EDR

SIEMs

Job description

SentinelOne is seeking a Senior DFIR Analyst to serve as the technical lead on breach response investigations for our 24x7x365 DFIR team. You will own evidence handling, documentation quality, and deliverables while coordinating with an Engagement Manager on scoping and customer communications.

You will apply depth in endpoint, network, and cloud forensics, threat hunting, malware analysis, and scripting (Python) to streamline investigations and reporting.