{"id":2840388,"url":"https://alion.io/job/sentinelone-senior-windows-detection-engineer","title":"Senior Windows Detection Engineer","company":{"id":46,"name":"SentinelOne","domain":"sentinelone.com","url":"https://alion.io/company/sentinelone","size_band":"1001-5000","is_staffing_agency":false,"employer_type":"direct","is_intermediary":false,"listed_via":null,"ats_vendor":"Greenhouse","truth_index":{"grade":"B","score":79,"open_postings":19,"ghost_share":0,"stale_share":0.842,"repost_share":0,"time_to_fill_p50_days":47,"computed_at":"2026-10-23T05:54:15Z"}},"role":"Security","role_family":"Security","seniority":"senior","employment_type":null,"work_mode":"on_site","remote_scope":null,"remote_scope_basis":null,"remote_working_hours":null,"hiring_geo_confidence":"structured","locations":["India"],"countries":["IN"],"hiring_countries":[],"hiring_countries_total":0,"salary":null,"salary_estimate":{"min_usd":22000,"max_usd":48000,"period":"year","method":"role_seniority_country_remote_cell","sample_n":11},"experience_years_min":null,"visa_sponsorship":false,"relocation_package":false,"has_equity":true,"technologies":[{"name":"C++","optional":false},{"name":"CI/CD","optional":false},{"name":"Jenkins","optional":false},{"name":"Python","optional":false},{"name":"Red Teaming","optional":false},{"name":"SentinelOne","optional":false},{"name":"SIEM","optional":false},{"name":"Windows","optional":false}],"status":"live","first_seen_at":"2026-10-19T07:41:52Z","employer_posted_date":"2026-10-19","last_verified_at":"2026-10-23T06:37:38Z","board_verified":true,"closed_at":null,"days_open":4,"trust":{"level":"ok","repost_count":null,"flags":[],"days_open":4},"description":"Our Purpose \nAt SentinelOne, we are driven by a clear purpose: to give the advantage to those who secure our future. As AI reshapes how organizations build, operate, and innovate, the responsibility to protect them becomes more critical than ever. When you join SentinelOne, your work helps protect global enterprises, critical infrastructure, and the technologies shaping tomorrow. If you are motivated by meaningful challenges and want your impact to be real, measurable, and global, you will find purpose here.\nAbout Us \nSentinelOne is a company at the intersection of AI and security, pioneering a new operating model for cybersecurity. Our AI-native platform unifies protection across endpoint, cloud, identity, data, and AI systems to deliver autonomous detection and response with clarity and speed. By combining real-time analytics, intelligent automation, and a unified data foundation, we reduce noise, simplify complexity, and empower security teams to focus on what truly matters.\nOur teams are builders, problem-solvers, and innovators committed to shaping the future of security. If you are excited to solve hard problems alongside talented, mission-driven people, we invite you to help us build a safer future for humanity.\nWhat Are We Looking For?\nWe’re looking for people who are relentlessly curious and committed to continuous learning. AI is reshaping every function across our business, and we enable every team member, regardless of role or level, to build fluency in AI tools and concepts. Those who thrive here actively seek out new solutions, experiment thoughtfully, and apply what they learn to drive better, faster, smarter outcomes.\nAs a Senior Windows Detection Engineer, you will be tasked with setting the technical direction for how SentinelOne detects threats on the Windows agent. You will own the detection content that ships by default on the SentinelOne Windows agent, writing behavioral rules that correlate process, file, registry, network, and other OS events into high-fidelity detections. As a senior engineer, you will also shape detection strategy, mentor other engineers, and influence how our detection capabilities evolve.\nWhat Will You Do?\nPrimary responsibilities include:\nResearch attacker tradecraft including intrusion sets, malware families, red team tooling, and emerging Windows TTPs, and translate findings into precise, resilient behavioral detections mapped to MITRE ATT&CK.\nDesign multi-event correlation logic that catches technique-level behavior rather than brittle indicators, with attention to evasion and bypass resistance.\nOwn the full rule lifecycle: hypothesis, authoring, validation, false-positive analysis, promotion to default, and ongoing tuning in production.\nAnalyze telemetry and alert data at scale to measure rule noise and efficacy, and drive improvements to precision and coverage.\nDefine and prioritize the detection backlog based on threat intelligence, customer impact, and coverage gaps across the ATT&CK matrix.\nReview peers' rules for logic, performance, and metadata quality, and set the standards for detection engineering practices across the team.\nWrite clear rule descriptions, metadata, and test cases so every detection is explainable, maintainable, and verifiable.\nPartner with threat research, agent and platform teams, and the MDR/SOC to feed real-world findings back into detection content and to propose improvements to rule capabilities and telemetry.\nMentor engineers on attacker tradecraft, detection design, and false-positive analysis.\nWhat Skills and Knowledge Will You Bring?\nIdeal candidates will have:\nSignificant experience in Detection Engineering, Threat Research, Red Teaming, or Offensive Research, including leading detection work at a senior or Staff level.\nDeep, hands-on experience writing behavioral detection rules for EDR, XDR, SIEM, or similar platforms.\nHands-on experience in malware analysis (static and dynamic), with the ability to analyze malicious behavior, understand attack techniques, and translate findings into effective behavioral detection logic.\nExpert understanding of modern Windows attack TTPs: initial access, execution, persistence, privilege escalation, credential access, defense evasion, lateral movement, and impact, including how real malware and operators behave on Windows.\nStrong working knowledge of Windows telemetry and the artifacts attackers leave behind (process, file, registry, network, scheduled tasks, services, WMI, and similar), and the ability to reason about what is detectable and what is not.\nProven ability to perform rigorous false-positive analysis: baselining benign behavior, quantifying noise, and tuning rules to balance coverage and precision.\nExperience using data analysis, scripting, or hunting queries to validate detections against large telemetry datasets; proficiency in Python is expected.\nTrack record of validating detections with adversary emulation or attack simulation such as Atomic Red Team, Caldera, or custom tooling.\nComfort working in a version-controlled, code-reviewed detection-as-code workflow, including writing tests for rules.\nStrong analytical and problem-solving skills, with sound judgment on prioritization and tradeoffs, and excellent written and verbal communication.\nExperience with Sigma, KQL/SPL, or other rule languages is preferred.\nExperience in reverse engineering Windows malware (x86/x64) is preferred.\nUnderstanding of EDR internals and how sensor telemetry is collected, and the ability to recommend new data sources that unlock better detections is preferred.\nWorking knowledge of Windows internals and C/C++ to support deeper behavioral research is preferred.\nFamiliarity with CI/CD tooling such as Jenkins and with unit and integration testing for detection content is preferred.\nWhy SentinelOne?\nAI is redefining how the world operates and rewriting the rules of security in real time, and SentinelOne was built for this moment. From day one, we architected an AI-native platform designed to operate at machine speed, not as an add-on to legacy systems but as the foundation itself. If you want to build where innovation and impact move together, this is that place.\nWe invest in our Sentinels with comprehensive, competitive benefits designed to support you and your family:\nEquity & Rewards\nRestricted Stock Units (RSUs)\nEmployee Stock Purchase Plan (ESPP)\nTime Off & Wellbeing\nCompetitive leave benefits\nGender-neutral parental leave\nInsurance & Financial Security\nMedical and insurance benefits\nEmployee Assistance Program (EAP)\nWork Perks & Flexibility\nGlobal home office allowance\nInternet allowance\nLinkedIn Learning license\nSocial Connect program\nFood allowance (Bangalore office)\nMeal vouchers (Sodexo)\nWellness & Lifestyle\nHealth & wellness benefit\nSentinelOne is proud to be an Equal Employment Opportunity and Affirmative Action employer. We do not discriminate based upon race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics.\nSentinelOne participates in the E-Verify Program for all U.S. based roles.","description_format":"text","description_chars":7282,"description_truncated":false,"requirements":{"experience_years_min":null,"management_years_min":null,"team_size_min":null,"manages_managers":false,"education":{"level":"phd","optional":false},"security_clearance":false,"languages":[]},"benefits":["Continuous learning","Equity","Home office","Parental leave","Restricted stock units"],"hiring_locations":[],"hiring_excludes":[],"relocation_offered":false,"industries":["Cloud Security","Endpoint Security","Security Operations","Cybersecurity AI"],"lifecycle":[{"event":"open","at":"2026-10-19T08:46:20Z"}],"visa":[],"liveness":{"score":63,"band":"ok","label":"Likely open","p_open":1,"p_active":0.632,"p_room":1,"age_days":3,"expected_fill_days":47,"reasons":["conf:3","stale_co","velocity","win:early","comp:brand"],"computed_at":"2026-10-23T05:54:15Z"},"pay":null,"html_url":"https://alion.io/job/sentinelone-senior-windows-detection-engineer","json_url":"https://alion.io/job/sentinelone-senior-windows-detection-engineer.json","meta":{"generated_at":"2026-10-23T09:08:20Z","cache_seconds":300,"methodology":"https://alion.io/methodology","terms":"https://alion.io/terms","contact":"https://alion.io/contact","api":"https://alion.io/developers","about":"Alion is a live layer of people, companies and AI agents: who they are, whether they are real and active right now, what they do and how to work with them, readable by people and by agents and paid per call.","catalog":"https://alion.io/catalog.json","usage":{"tier":"crawler_verified","counted_by":"address","units_charged":1,"used_today":14669,"day_limit":null,"remaining_today":null,"minute_limit":300,"resets_at":"2026-10-24T00:00:00Z"}},"offers":[{"id":"company.slices","title":"One company in depth, by slice","status":"live","price":{"credits":0.02,"usd":0.002,"plus_per_slice":{"credits":0.05,"usd":0.005}},"unit":"per company, plus each slice with data","note":"the employer in depth","call":{"mcp_tool":"get_company","arguments":{"id":46},"rest":"https://alion.io/mcp/rest/get_company?id=46"},"human":"https://alion.io/catalog?offer=company.slices&for=job%2Fsentinelone-senior-windows-detection-engineer"},{"id":"market.stats","title":"A market slice: pay, demand and time to fill","status":"live","price":{"credits":1,"usd":0.1},"unit":"per slice","note":"pay, demand and time to fill for this role and place","call":{"mcp_tool":"market_stats"},"human":"https://alion.io/catalog?offer=market.stats&for=job%2Fsentinelone-senior-windows-detection-engineer"},{"id":"job.search","title":"Open jobs by role, technology, place, pay and visa","status":"live","price":{"credits":0.02,"usd":0.002},"unit":"per posting in a list","note":"similar open postings","call":{"mcp_tool":"search_jobs"},"human":"https://alion.io/catalog?offer=job.search&for=job%2Fsentinelone-senior-windows-detection-engineer"},{"id":"company.verify","title":"Is this company real and active right now","status":"pilot","price":null,"unit":"per company","request":{"url":"https://alion.io/catalog/request","method":"POST","body":"{\"offer\": \"company.verify\", \"for\": \"job/sentinelone-senior-windows-detection-engineer\", \"note\": \"what you need it for\"}"},"human":"https://alion.io/catalog?offer=company.verify&for=job%2Fsentinelone-senior-windows-detection-engineer"}]}