Sr. DFIR Analyst

Primary responsibilities include:

Serve as technical lead on DFIR engagements, directing analytical focus and partnering with the Engagement Manager to align technical work with scope and client expectations.

Support case intake by gathering initial technical details and assessing scope.

Conduct EDR-driven incident response and vendor-agnostic advanced forensic analysis spanning endpoint, network, cloud, and SaaS environments (including ransomware, business email compromise, identity compromise, and other common incident types).

Develop tactical containment guidance and remediation recommendations tailored to each engagement's specific attack pattern.

Contribute observed attacker techniques and indicators to the team's shared knowledge base.

Acquire and preserve forensic evidence from endpoint, network, and cloud sources following standard chain-of-custody procedures, with clear, thorough case documentation throughout each investigation.

Support the preparation and delivery of interim status updates and deliverables.

Own evidence handling, documentation standards, and the accuracy and quality of formal investigative reports for assigned engagements, ensuring findings are defensible, well-supported, and peer-reviewed before reaching a customer, breach counsel, or other stakeholder.

Lead case handovers for assigned engagements, ensuring a complete, clear transfer of status when work moves across regions.

Mentor Analysts on technical methodology, evidence handling, and investigative best practices.

Manage triage and analysis in high-pressure, large-scale incidents, maintaining composure and clear decision-making.

Build or improve scripts, tooling, and internal processes — including AI-assisted approaches where useful — to streamline recurring forensic, analysis, and reporting workflows.

Escalate scope, resourcing, or customer relationship concerns to the EM promptly, while owning technical escalations directly.

Track hours for investigations accurately and in a timely fashion.

Participate in a rotating on-call schedule for weekends and holidays, to support active incident response.

Maintain awareness of emerging threats, attacker techniques, and evolving cybersecurity trends.

AI is redefining how the world operates and rewriting the rules of security in real time, and SentinelOne was built for this moment. From day one, we architected an AI-native platform designed to operate at machine speed, not as an add-on to legacy systems but as the foundation itself. If you want to build where innovation and impact move together, this is that place.

We invest in our Sentinels with comprehensive, competitive benefits designed to support you and your family:

Restricted Stock Units (RSUs)

Employee Stock Purchase Plan (ESPP)

Flexible time off

Paid company holidays and paid sick time

Gender-neutral parental leave

Grandparent leave

Medical, dental, and vision coverage

401(k) retirement plan with company match

Life and disability insurance

Health and dependent care FSA

Voluntary benefits (hospital, accident, critical illness)

Employee Assistance Program (EAP)

ARAG pre-paid legal

Nationwide pet insurance

Cancer Care program

Global business travel medical insurance

Wellness coach

Wellness/gym reimbursement

Fertility coverage

Adoption & surrogacy reimbursement

This U.S. role has a base pay range that will vary based on the location of the candidate. For some locations, a different pay range may apply. If so, this range will be provided to you during the recruiting process. You can also reach out to the recruiter with any questions.

SentinelOne is proud to be an Equal Employment Opportunity and Affirmative Action employer. We do not discriminate based upon race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics.

SentinelOne participates in the E-Verify Program for all U.S. based roles.