Senior Detection Engineer

Our Purpose At SentinelOne, we are driven by a clear purpose: to give the advantage to those who secure our future. As AI reshapes how organizations build, operate, and innovate, the responsibility to protect them becomes more critical than ever. When you join SentinelOne, your work helps protect global enterprises, critical infrastructure, and the technologies shaping tomorrow. If you are motivated by meaningful challenges and want your impact to be real, measurable, and global, you will find purpose here. About Us SentinelOne is a company at the intersection of AI and security, pioneering a new operating model for cybersecurity. Our AI-native platform unifies protection across endpoint, cloud, identity, data, and AI systems to deliver autonomous detection and response with clarity and speed. By combining real-time analytics, intelligent automation, and a unified data foundation, we reduce noise, simplify complexity, and empower security teams to focus on what truly matters. Our teams are builders, problem-solvers, and innovators committed to shaping the future of security. If you are excited to solve hard problems alongside talented, mission-driven people, we invite you to help us build a safer future for humanity. What Are We Looking For? We’re looking for people who are relentlessly curious and committed to continuous learning. AI is reshaping every function across our business, and we enable every team member, regardless of role or level, to build fluency in AI tools and concepts. Those who thrive here actively seek out new solutions, experiment thoughtfully, and apply what they learn to drive better, faster, smarter outcomes. As a Senior Detection Engineer, you will be tasked with owning detections end to end, from the first hypothesis to a rule that runs quietly and catches real threats in production. You will craft, validate, and tune detection rules across EDR, XDR, cloud, and network data sources, working closely with research, product management, and data-pipeline teams to prioritize coverage. What Will You Do? Primary responsibilities include: Craft, own, and package detection rules for EDR, XDR, cloud, and network data sources. Build rules that correlate detections across third-party sources and over time. Turn hunt findings and threat research into detections, or document clearly why a behavior cannot be detected reliably. Validate every rule against real or lab telemetry before it ships, measuring noise and confirming true positives. Analyze false positives rigorously, and tune new and existing rules to improve detection accuracy. Respond promptly to customer escalations and false-positive reports. Review teammates' pull requests with specific, actionable feedback, and write clear PR descriptions and ticket updates. Stay current on emerging threats, industry trends, and new technologies, and apply them to improve rule efficacy.