Senior SentinelOne Engineer - SIEM & EDR Expert

True Zero Technologies LLC.; United States; On-site; USD 120,000 - 190,000; Full time

Benefits offered by this job

Competitive salary

Medical coverage

Incentive programs

PTO 3 weeks + holidays

401(k) match

Cell phone reimbursement

Parental leave

Job summary

True Zero Technologies is seeking a Certified SentinelOne Engineer to lead ongoing operations, tuning, and optimization of SentinelOne across secure, mission-critical environments — including use of the platform as a SIEM for centralized log management, detection, and correlation.

The ideal candidate holds current SentinelOne Certified Engineer status and brings hands-on experience in production SentinelOne administration, SIEM integration, and threat hunting to deliver reliable endpoint and

Qualifications

• Must be a SentinelOne Certified Engineer (current certification required).
• Minimum of 3–5 years in endpoint security, detection engineering, or SOC operations with substantial hands-on SentinelOne administration.
• Experience with ongoing SentinelOne operations as a SIEM platform, including log management, correlation, and alert tuning.
• Hands-on experience with EDR/XDR administration, policy tuning, Deep Visibility/Storyline queries, and threat hunting workflows.
• Experience integrating EDR/SIEM platforms with SOAR, ticketing, and broader security tooling.
• Familiarity with NIST SP 800-53, Zero Trust architecture, and security compliance frameworks.
• Bachelor’s degree in CS/Cybersecurity/IT or related field preferred; equivalent experience considered.

Responsibilities

• Own day-to-day SentinelOne platform operations across managed environments, including agent deployment and fleet health.
• Operate and optimize SentinelOne’s SIEM capabilities—log ingestion, correlation rules, dashboards, and alerting.
• Design, tune, and validate detection policies and Deep Visibility/Storyline queries.
• Support triage, investigation, and remediation of SentinelOne-detected threats, including threat hunting.
• Integrate SentinelOne with SIEM, SOAR, ticketing, and other security tooling for seamless data flow.
• Monitor agent health, policy coverage, and platform performance; address gaps across the fleet.
• Manage SentinelOne upgrades, policy version control, and lifecycle changes.
• Ensure governance and compliance with regulatory requirements and Zero Trust principles.
• Provide technical reporting on endpoint and SIEM health, tuning outcomes, and recommendations.
• Engage with clients and stakeholders, including state government customers.
• Coach and mentor junior engineers on SentinelOne operations and detection engineering best practices.

Skills

SentinelOne admin

EDR/XDR

Policy tuning

Storyline queries

Threat hunting

SOAR integration

Communication

Education

Bachelor’s degree preferred

Tools

Splunk

CrowdStrike

Job description

True Zero Technologies is seeking a Certified SentinelOne Engineer to lead ongoing operations, tuning, and optimization of SentinelOne across secure, mission-critical environments — including use of the platform as a SIEM for centralized log management, detection, and correlation.

The ideal candidate holds current SentinelOne Certified Engineer status and brings hands-on experience in production SentinelOne administration, SIEM integration, and threat hunting to deliver reliable endpoint and