SentinelOne Engineer

Accountabilities:

SentinelOne Platform Administration
Lead the day-to-day administration and management of SentinelOne across multiple managed environments.
Oversee endpoint agent deployment, configuration, policy management, and overall fleet health.
Ensure consistent platform performance, security coverage, and operational reliability.
SIEM Operations and Optimization
Manage and continuously optimize SentinelOne's SIEM capabilities, including centralized log ingestion, management, correlation rules, dashboards, and alerting.
Improve detection coverage while reducing false positives and unnecessary security alerts.
Ensure effective log analysis and monitoring to support proactive threat identification.
Detection Engineering and Tuning
Design, configure, test, and refine endpoint detection and response policies.
Develop and optimize Deep Visibility and Storyline queries to identify suspicious activities and emerging threats.
Continuously improve detection capabilities to address evolving cybersecurity risks while minimizing unnecessary analyst workload.
Incident Response and Threat Investigation
Support the triage, investigation, and remediation of threats identified through the SentinelOne platform.
Conduct threat hunting activities and root-cause analysis to identify security incidents and potential vulnerabilities.
Recommend and implement appropriate remediation strategies to strengthen endpoint and organizational security.
Systems Integration
Integrate SentinelOne with SIEM, Security Orchestration, Automation and Response (SOAR), ticketing systems, and other enterprise security technologies.
Ensure seamless data exchange, centralized visibility, and efficient security workflows across integrated platforms.
Performance Monitoring and Lifecycle Management
Monitor endpoint agent health, policy coverage, and overall platform performance.
Identify security gaps and implement corrective actions across managed environments.
Manage platform upgrades, policy version control, and lifecycle changes while minimizing operational disruption.
Governance and Compliance
Ensure SentinelOne operations align with applicable regulatory and security requirements, including NIST SP 800-53 and Zero Trust principles.
Support compliance with state-specific security requirements and other relevant governance standards.
Maintain operational practices that promote secure, consistent, and auditable endpoint protection.
Reporting and Client Collaboration
Prepare technical reports covering endpoint health, SIEM performance, detection capabilities, and security optimization outcomes.
Provide actionable recommendations to improve security posture and operational effectiveness.
Engage with clients and stakeholders throughout project and service delivery activities, including state government customers where applicable.
Technical Leadership and Mentoring
Coach and mentor junior engineers on SentinelOne administration, detection engineering, and cybersecurity best practices.
Share technical expertise and contribute to continuous improvements in engineering processes and security operations.
Requirements:
Current SentinelOne Certified Engineer certification is mandatory.
At least 3–5 years of professional experience in endpoint security, detection engineering, or Security Operations Center (SOC) operations.
Substantial hands-on experience administering, managing, and optimizing SentinelOne in production environments.
Demonstrated experience operating and continuously improving SentinelOne as a SIEM platform, including log management, correlation rules, and alert tuning.
Strong technical knowledge of Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) technologies.
Practical experience with endpoint security policy configuration, Deep Visibility and Storyline queries, and threat hunting workflows.
Experience integrating EDR and SIEM platforms with SOAR solutions, ticketing systems, and broader enterprise security tools.
Familiarity with NIST SP 800-53, Zero Trust architecture principles, and general cybersecurity governance and compliance frameworks.
Strong troubleshooting, analytical, and problem-solving abilities, with the capacity to investigate complex security issues and recommend effective solutions.
Excellent written and verbal communication skills, with the ability to explain technical concepts to both technical and non-technical stakeholders.
Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field preferred; equivalent professional experience will also be considered.
Preferred Qualifications:
Previous experience supporting state, local, and education (SLED) government customers.
Additional cybersecurity certifications such as Security+, CySA+, GCIH, or equivalent credentials.
Familiarity with other endpoint detection and SIEM platforms, including Splunk and CrowdStrike.
Previous experience working for a veteran-owned small business or a government-focused contractor.
Strong mentoring and technical leadership capabilities, with experience guiding junior cybersecurity professionals.
Benefits:
Competitive compensation: Attractive salary package, paid twice monthly.
Healthcare coverage: Comprehensive medical insurance, with 100% of medical premiums covered by the employer.
Retirement savings: 401(k) plan with a 100% company match on the first 4% of eligible contributions.
Paid time off: Three weeks of PTO starting from the first year of employment.
Paid holidays: 11 paid holidays annually.
Family support: Paid maternity and paternity leave.
Remote work support: Monthly reimbursement for cell phone and home internet expenses.
Business development incentives: Companywide incentive programs rewarding contributions to new business opportunities.
Knowledge-sharing incentives: Additional recognition for contributions such as white papers, blog posts, and internal webinars.
Professional growth: Opportunities to develop technical expertise and contribute to innovative cybersecurity initiatives.
Work flexibility: Fully remote working arrangement within the United States.