SentinelOne Engineer

This position is listed on behalf of a partner company, who manages all applications and next steps. Our partner is looking for a SentinelOne Engineer based in the United States.

The SentinelOne Engineer will play a critical role in managing, securing, and optimizing advanced endpoint detection and response capabilities across mission-critical environments. In this senior technical position, you will lead the administration and continuous improvement of the SentinelOne platform, including its use as a Security Information and Event Management (SIEM) solution. You will develop and fine-tune detection policies, manage endpoint security operations, and strengthen threat monitoring and incident response capabilities. Working within security frameworks such as NIST and Zero Trust, you will help organizations maintain strong security postures while minimizing false positives and operational disruptions. You will collaborate with clients, cybersecurity specialists, and technical teams to deliver reliable, scalable, and compliant security solutions. This is an excellent opportunity for a certified cybersecurity professional to combine hands-on engineering expertise, technical leadership, and client engagement in a dynamic remote environment.

SentinelOne Platform Administration Lead the day-to-day administration and management of SentinelOne across multiple managed environments. Oversee endpoint agent deployment, configuration, policy management, and overall fleet health. Ensure consistent platform performance, security coverage, and operational reliability. SIEM Operations and Optimization Manage and continuously optimize SentinelOne's SIEM capabilities, including centralized log ingestion, management, correlation rules, dashboards, and alerting. Improve detection coverage while reducing false positives and unnecessary security alerts. Ensure effective log analysis and monitoring to support proactive threat identification. Detection Engineering and Tuning Design, configure, test, and refine endpoint detection and response policies. Develop and optimize Deep Visibility and Storyline queries to identify suspicious activities and emerging threats. Continuously improve detection capabilities to address evolving cybersecurity risks while minimizing unnecessary analyst workload. Incident Response and Threat Investigation Support the triage, investigation, and remediation of threats identified through the SentinelOne platform. Conduct threat hunting activities and root-cause analysis to identify security incidents and potential vulnerabilities. Recommend and implement appropriate remediation strategies to strengthen endpoint and organizational security. Systems Integration Integrate SentinelOne with SIEM, Security Orchestration, Automation and Response (SOAR), ticketing systems, and other enterprise security technologies. Ensure seamless data exchange, centralized visibility, and efficient security workflows across integrated platforms. Performance Monitoring and Lifecycle Management Monitor endpoint agent health, policy coverage, and overall platform performance. Identify security gaps and implement corrective actions across managed environments. Manage platform upgrades, policy version control, and lifecycle changes while minimizing operational disruption. Governance and Compliance Ensure SentinelOne operations align with applicable regulatory and security requirements, including NIST SP 800-53 and Zero Trust principles. Support compliance with state-specific security requirements and other relevant governance standards. Maintain operational practices that promote secure, consistent, and auditable endpoint protection. Reporting and Client Collaboration Prepare technical reports covering endpoint health, SIEM performance, detection capabilities, and security optimization outcomes. Provide actionable recommendations to improve security posture and operational effectiveness. Engage with clients and stakeholders throughout project and service delivery activities, including state government customers where applicable. Technical Leadership and Mentoring Coach and mentor junior engineers on SentinelOne administration, detection engineering, and cybersecurity best practices. Share technical expertise and contribute to continuous improvements in engineering processes and security operations.

Requirements:

Current SentinelOne Certified Engineer certification is mandatory. At least 3–5 years of professional experience in endpoint security, detection engineering, or Security Operations Center (SOC) operations. Substantial hands-on experience administering, managing, and optimizing SentinelOne in production environments. Demonstrated experience operating and continuously improving SentinelOne as a SIEM platform, including log management, correlation rules, and alert tuning. Strong technical knowledge of Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) technologies. Practical experience with endpoint security policy configuration, Deep Visibility and Storyline queries, and threat hunting workflows. Experience integrating EDR and SIEM platforms with SOAR solutions, ticketing systems, and broader enterprise security tools. Familiarity with NIST SP 800-53, Zero Trust architecture principles, and general cybersecurity governance and compliance frameworks. Strong troubleshooting, analytical, and problem-solving abilities, with the capacity to investigate complex security issues and recommend effective solutions. Excellent written and verbal communication skills, with the ability to explain technical concepts to both technical and non-technical stakeholders. Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field preferred; equivalent professional experience will also be considered.

Preferred Qualifications:

Previous experience supporting state, local, and education (SLED) government customers. Additional cybersecurity certifications such as Security+, CySA+, GCIH, or equivalent credentials. Familiarity with other endpoint detection and SIEM platforms, including Splunk and CrowdStrike. Previous experience working for a veteran-owned small business or a government-focused contractor. Strong mentoring and technical leadership capabilities, with experience guiding junior cybersecurity professionals.

Benefits:

Competitive compensation: Attractive salary package, paid twice monthly. Healthcare coverage: Comprehensive medical insurance, with 100% of medical premiums covered by the employer. Retirement savings: 401(k) plan with a 100% company match on the first 4% of eligible contributions. Paid time off: Three weeks of PTO starting from the first year of employment. Paid holidays: 11 paid holidays annually. Family support: Paid maternity and paternity leave. Remote work support: Monthly reimbursement for cell phone and home internet expenses. Business development incentives: Companywide incentive programs rewarding contributions to new business opportunities. Knowledge-sharing incentives: Additional recognition for contributions such as white papers, blog posts, and internal webinars. Professional growth: Opportunities to develop technical expertise and contribute to innovative cybersecurity initiatives. Work flexibility: Fully remote working arrangement within the United States.

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

 Why Apply Through Jobgether? 

 

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

 

 

#LI-CL1