Senior Detection Engineer

8 hours, 48 minutes ago
Full-time
Senior
Cybersecurity
SentinelOne

SentinelOne

SentinelOne provides autonomous security solutions for endpoint, cloud, and identity environments, offering unified prevention, detection, response, and forensics in a single platform powered by AI to protect against advanced cyber threats.

Internet Software & Services
1001-5000
Founded 2013

Description

  • Own the end-to-end lifecycle of detection rules, from hypotheses through production deployment.
  • Create and package detection rules for EDR, XDR, cloud, and network telemetry.
  • Build correlation rules across third-party data sources and time periods.
  • Translate threat research and hunting findings into reliable detections, documenting behaviors that cannot be detected.
  • Validate rules against lab or real-world telemetry, measuring noise and confirming true positives before release.
  • Investigate false positives and tune new and existing rules to improve accuracy.
  • Respond to customer escalations and false-positive reports.
  • Review pull requests, maintain clear ticket documentation, and provide actionable feedback.
  • Monitor emerging threats and technologies to improve detection coverage and efficacy.
  • Partner with research, product management, and data-pipeline teams on coverage priorities and quarterly roadmaps.

Requirements

  • 4+ years of experience in detection engineering, threat detection, SOC engineering, or a related security role.
  • Experience writing behavioral detections for SIEM, EDR, XDR, or similar platforms using S1QL/SDL, Sigma, KQL, SPL, or comparable query languages.
  • Knowledge of the MITRE ATT&CK framework and mapping adversary techniques to observable behaviors.
  • Strong log-analysis skills across Windows, Linux, and network telemetry.
  • Experience analyzing false positives and identifying root causes.
  • Proficiency in scripting or programming, preferably Python, plus Git and pull-request workflows.
  • Familiarity with detection engineering processes, including backlog prioritization, unit and integration testing, and CI/CD.
  • Knowledge of cybersecurity frameworks, threat intelligence, and industry best practices.
  • Clear written communication, collaborative working style, and ownership of tickets through resolution.
  • Experience maintaining detections for a cybersecurity software product, SOC alert triage, YARA/static detections, cloud and identity logs, threat hunting, detection test automation, MITRE ATT&CK Evaluations, or AI coding assistants is preferred.

Benefits

  • Restricted Stock Units (RSUs) and an Employee Stock Purchase Plan (ESPP).
  • Competitive leave benefits and gender-neutral parental leave.
  • Medical and insurance benefits, plus an Employee Assistance Program.
  • Global home-office and internet allowances.
  • LinkedIn Learning license and Social Connect program.
  • Food allowance for the Bangalore office and Sodexo meal vouchers.
  • Health and wellness benefit.

Interested in this position?

Apply directly on the company website

Apply Now

Similar Roles

Platform Security Engineer

Fly.io 11-50 Internet Software & Services

Fly.io is hiring a senior Platform Security Engineer to harden Linux-based VM and host isolation across its globally distributed cloud platform and reduce the impact of potential guest-to-host escapes.

Cybersecurity
10 hours, 48 minutes ago

AI-Native Detection and Triage Engineer

Fly.io 11-50 Internet Software & Services

Fly.io is seeking a security detection engineer to unify fleet and code security signals into an agentic triage pipeline that identifies, investigates, and drives resolution of isolation threats across its global cloud platform.

Elixir Go Linux LLM Rust SIEM
10 hours, 48 minutes ago

Network Security Engineer

FireMon.com 201-500 Professional Services

FireMon is seeking a hands-on Network Security Engineer to develop, test, and support integrations that enable its network security policy management platform to work across enterprise security devices and environments.

Cisco Juniper Network Security
11 hours, 3 minutes ago

Information Security Lead

Mama Money 201-500 Diversified Financial Services

Lead end-to-end security at Mama Money, a Cape Town-based fintech serving migrants and underserved communities, with a focus on securing APIs, partner integrations, cloud systems and regulatory controls.

AWS Bash Kubernetes OpenID Connect Penetration Testing Python Secrets Management SIEM Terraform
11 hours, 3 minutes ago

You're on a roll! Sign up now to keep applying.

Sign Up

Already have an account? Log in

Used by 14,729+ remote workers