Senior Windows Detection Engineer
Core
Designing and maintaining behavioral threat detection rules for the SentinelOne Windows agent to protect global enterprises from cyberattacks.
Role type
Senior IC detection engineer (Windows endpoint security)
Builds
Default detection content and behavioral rules for the SentinelOne Windows agent
Domain
Cybersecurity, Endpoint Detection and Response (EDR), Windows internals
Deliverable
production ML models
Required skills
Behavioral detection rule authoring, Windows telemetry analysis, Malware analysis (static/dynamic), MITRE ATT&CK mapping, False-positive analysis, Python scripting, Adversary emulation, Detection-as-code workflows
Preferred skills
Sigma/KQL/SPL, Reverse engineering Windows malware, EDR internals, C/C++, CI/CD tooling
Responsibilities
Research attacker tradecraft and translate into behavioral detections, Design multi-event correlation logic, Own the full rule lifecycle from hypothesis to production tuning, Analyze telemetry to measure rule efficacy, Define detection backlog based on threat intelligence, Review peers' rules and set team standards
Seniority
Senior, hands-on IC with mentorship responsibilities
