Staff Cloud Security Researcher — Cloud & Attacker Tradecraft

SentinelOne, Inc.; United States; Remote; USD 180,000 - 240,000; Full time

Benefits offered by this job

RSUs

ESPP

Competitive leave

Gender-neutral parental leave

Medical benefits

Pension

Employee Assistance Program (EAP)

Global home office allowance

Home office stipend

Meal allowance

Transportation allowance

Job summary

SentinelOne seeks a Staff Cloud Workload Security Researcher to join a global team spanning Windows, Linux, and macOS, covering Endpoint, Cloud, and Identity. You will research evasions against our sensors, map attacker tradecraft, and drive next-generation detection capabilities.

You will build tools, develop PoCs, and collaborate with threat intelligence and engineering teams to close gaps in detection and visibility, contributing to safer, autonomous protection across cloud environments.

Qualifications

• 4+ years in red teaming, security research, or offensive research.
• Deep OS internals knowledge (Windows/Linux).
• Hands-on coding in Python and C/C++.
• Familiarity with cloud providers and Kubernetes.

Responsibilities

• Research evasions against SentinelOne sensors and emulate attacks to improve detection.
• Analyze attack paths in cloud environments and across Windows/Linux/macOS.
• Identify and prioritize vulnerabilities in cloud platforms.
• Develop tools to support detection assessments and create PoCs.
• Collaborate with threat intel and engineering teams to close gaps in detection and visibility.

Skills

Cloud attack path analysis

Vulnerability assessment

Threat modeling

Kubernetes

AWS

GCP

Azure

Python

C/C++

OS internals

EDR internals

Threat intelligence

Public speaking

Job description

SentinelOne seeks a Staff Cloud Workload Security Researcher to join a global team spanning Windows, Linux, and macOS, covering Endpoint, Cloud, and Identity. You will research evasions against our sensors, map attacker tradecraft, and drive next-generation detection capabilities.

You will build tools, develop PoCs, and collaborate with threat intelligence and engineering teams to close gaps in detection and visibility, contributing to safer, autonomous protection across cloud environments.