Senior Detection Engineer

As a Senior Detection Engineer, you will be tasked with owning detections end to end, from the first hypothesis to a rule that runs quietly and catches real threats in production. You will craft, validate, and tune detection rules across EDR, XDR, cloud, and network data sources, working closely with research, product management, and data-pipeline teams to prioritize coverage.

What Will You Do?

Primary responsibilities include:

Craft, own, and package detection rules for EDR, XDR, cloud, and network data sources.

Build rules that correlate detections across third-party sources and over time.

Turn hunt findings and threat research into detections, or document clearly why a behavior cannot be detected reliably.

Validate every rule against real or lab telemetry before it ships, measuring noise and confirming true positives.

Analyze false positives rigorously, and tune new and existing rules to improve detection accuracy.

Respond promptly to customer escalations and false-positive reports.

Review teammates' pull requests with specific, actionable feedback, and write clear PR descriptions and ticket updates.

Stay current on emerging threats, industry trends, and new technologies, and apply them to improve rule efficacy.

Work with research, product management, and data-pipeline teams to prioritize coverage and plan quarterly roadmaps.

What Skills and Knowledge Will You Bring?

Ideal candidates will have:

4 or more years in detection engineering, threat detection, SOC engineering, or a closely related security role.

Experience writing behavioral detection rules for SIEM, EDR, XDR, or similar platforms, using query languages such as S1QL/SDL, Sigma, KQL, or SPL.

Familiarity with building detections across the MITRE ATT&CK matrix, and how adversary techniques map to observable behavior.

Strong log analysis skills across Windows, Linux, and network telemetry, including the ability to separate real findings from logging artifacts.

Strong analytical and problem-solving skills, with a solid grasp of false-positive analysis and root causes such as overly broad string matching.

Proficiency in scripting and programming, with Python preferred, and comfort with Git and pull-request workflows.

Familiarity with detection engineering processes, including prioritizing a research and development backlog, writing unit and integration tests, and working with CI/CD.

Knowledge of cybersecurity frameworks, threat intelligence, and industry best practices.

Clear written communication and a collaborative, team-oriented approach: you document what you tested, what you found, and why you made each call.

Ownership: you drive tickets to a decision, flag blockers early, and respond to stakeholders without being chased.

Experience building and maintaining detections for a cybersecurity software product is preferred.

Experience in a SOC or similar environment where detection products were used and alerts triaged is preferred.

Experience writing YARA or other static detections is preferred.

Experience with cloud, identity, and SaaS logs (AWS, Azure, Okta, Microsoft 365, or similar) is preferred.

Threat research or threat hunting background, including turning hunts into detections, is preferred.

Experience building test automation for detections, such as CI checks that validate rules before merge, is preferred.

Familiarity with detection evaluation frameworks, including MITRE ATT&CK Evaluations, is preferred.

Experience using AI coding assistants to speed up scripting, testing, and tooling, with judgment about checking their output, is preferred.

Why SentinelOne?

AI is redefining how the world operates and rewriting the rules of security in real time, and SentinelOne was built for this moment. From day one, we architected an AI-native platform designed to operate at machine speed, not as an add-on to legacy systems but as the foundation itself. If you want to build where innovation and impact move together, this is that place.

We invest in our Sentinels with comprehensive, competitive benefits designed to support you and your family:

Equity & Rewards

Restricted Stock Units (RSUs)

Employee Stock Purchase Plan (ESPP)

Time Off & Wellbeing

Competitive leave benefits

Gender-neutral parental leave

Insurance & Financial Security

Medical and insurance benefits

Employee Assistance Program (EAP)

Work Perks & Flexibility

Global home office allowance

Internet allowance

LinkedIn Learning license

Social Connect program

Food allowance (Bangalore office)

Meal vouchers (Sodexo)

Wellness & Lifestyle

Health & wellness benefit