Senior Malware Detection Engineer

What Will You Do?

What Skills and Knowledge Will You Bring?

• Ideal candidates will have:
• A dedication to continuous learning and skill development to meet evolving job demands. 5+ years of experience in both static and dynamic malware analysis and reverse engineering, with proven depth on Linux and working knowledge of macOS (or vice versa). Proficiency with reverse engineering and analysis tools, such as disassemblers, compilers, and debuggers like IDA, Ghidra, Hopper, LLDB, GDB. Strong background in malware analysis and understanding its behavior, including advanced techniques such as anti-tampering, defense evasion, lateral movement, persistence, and ransomware activity. Good understanding of MITRE ATT&CK TTPs. A strong inclination toward automating routine analysis and detection workflows. Excellent and deep understanding of Linux (both user-mode and kernel-mode): Core system internals — processes and threads, IPC, tracing (including eBPF), security, virtual memory — and how they work behind the scenes. Understanding of containers and Kubernetes, including common container escape and cloud-native attack techniques. For macOS: Understanding of ARM64/Apple Silicon architecture. Understanding of sandbox internals/escapes, and Transparency, Consent and Control (TCC) internals/escapes. Understanding of security mechanisms such as File Quarantine, XProtect, and Gatekeeper. Programming experience: Assembly, C/C++, Objective-C (for macOS), Python. Experience creating production detection rules using YARA/plist or similar engines. Preferred / Advantages (One or more) Exposure to AI/LLM-assisted reverse engineering or detection-authoring tooling. Good understanding of existing AV/EDR/EPP internals and detection mechanisms. Experience building CI/CD pipelines (Jenkins, GitHub Actions, or similar) for shipping detection content. Familiarity with attack simulation frameworks (BAS) and their TTPs. Experience querying large-scale telemetry (SQL, EventDB/DataSet, Redash, or similar) to validate detections.
• A dedication to continuous learning and skill development to meet evolving job demands.
• 5+ years of experience in both static and dynamic malware analysis and reverse engineering, with proven depth on Linux and working knowledge of macOS (or vice versa).
• Proficiency with reverse engineering and analysis tools, such as disassemblers, compilers, and debuggers like IDA, Ghidra, Hopper, LLDB, GDB.
• Strong background in malware analysis and understanding its behavior, including advanced techniques such as anti-tampering, defense evasion, lateral movement, persistence, and ransomware activity.
• Good understanding of MITRE ATT&CK TTPs.
• A strong inclination toward automating routine analysis and detection workflows.
• Excellent and deep understanding of Linux (both user-mode and kernel-mode):
• Core system internals — processes and threads, IPC, tracing (including eBPF), security, virtual memory — and how they work behind the scenes.
• Understanding of containers and Kubernetes, including common container escape and cloud-native attack techniques.
• For macOS:
• Understanding of ARM64/Apple Silicon architecture.
• Understanding of sandbox internals/escapes, and Transparency, Consent and Control (TCC) internals/escapes.
• Understanding of security mechanisms such as File Quarantine, XProtect, and Gatekeeper.
• Programming experience: Assembly, C/C++, Objective-C (for macOS), Python.
• Experience creating production detection rules using YARA/plist or similar engines.
• Exposure to AI/LLM-assisted reverse engineering or detection-authoring tooling.
• Good understanding of existing AV/EDR/EPP internals and detection mechanisms.
• Experience building CI/CD pipelines (Jenkins, GitHub Actions, or similar) for shipping detection content.
• Familiarity with attack simulation frameworks (BAS) and their TTPs.
• Experience querying large-scale telemetry (SQL, EventDB/DataSet, Redash, or similar) to validate detections.

Why SentinelOne?

Equity & Rewards

Time Off & Wellbeing

Insurance & Financial Security

Work Perks & Flexibility

• Global home office allowance
• Internet allowance
• LinkedIn Learning license
• Social Connect program
• Food allowance (Bangalore office)
• Meal vouchers (Sodexo)

Wellness & Lifestyle