Sr. DFIR Analyst

Our Purpose

At Sentinel One, we are driven by a clear purpose: to give the advantage to those who secure our future. As AI reshapes how organizations build, operate, and innovate, the responsibility to protect them becomes more critical than ever. When you join Sentinel One, your work helps protect global enterprises, critical infrastructure, and the technologies shaping tomorrow. If you are motivated by meaningful challenges and want your impact to be real, measurable, and global, you will find purpose here.

Sentinel One is a company at the intersection of AI and security, pioneering a new operating model for cybersecurity. Our AI-native platform unifies protection across endpoint, cloud, identity, data, and AI systems to deliver autonomous detection and response with clarity and speed. By combining real-time analytics, intelligent automation, and a unified data foundation, we reduce noise, simplify complexity, and empower security teams to focus on what truly matters.

Our teams are builders, problem-solvers, and innovators committed to shaping the future of security. If you are excited to solve hard problems alongside talented, mission-driven people, we invite you to help us build a safer future for humanity.

We’re looking for people who are relentlessly curious and committed to continuous learning. AI is reshaping every function across our business, and we enable every team member, regardless of role or level, to build fluency in AI tools and concepts. Those who thrive here actively seek out new solutions, experiment thoughtfully, and apply what they learn to drive better, faster, smarter outcomes.

As a Senior DFIR Analyst, you will be tasked with serving as technical lead on small to medium-sized breach response investigations for Sentinel One’s 24x7x365, follow-the-sun DFIR team. You’ll own case-level evidence and documentation quality end-to-end, partnering closely with an Engagement Manager on scoping, case strategy, and customer communications, and bringing strong, well-rounded technical depth across threat hunting and endpoint, network, and cloud forensics.

What Will You Do?

Primary responsibilities include:

• Serve as technical lead on DFIR engagements, directing analytical focus and partnering with the Engagement Manager to align technical work with scope and client expectations.
• Support case intake by gathering initial technical details and assessing scope.
• Conduct EDR-driven incident response and vendor-agnostic advanced forensic analysis spanning endpoint, network, cloud, and SaaS environments (including ransomware, business email compromise, identity compromise, and other common incident types).
• Develop tactical containment guidance and remediation recommendations tailored to each engagement’s specific attack pattern.
• Contribute observed attacker techniques and indicators to the team’s shared knowledge base.
• Acquire and preserve forensic evidence from endpoint, network, and cloud sources following standard chain-of-custody procedures, with clear, thorough case documentation throughout each investigation.
• Support the preparation and delivery of interim status updates and deliverables.
• Own evidence handling, documentation standards, and the accuracy and quality of formal investigative reports for assigned engagements, ensuring findings are defensible, well-supported, and peer-reviewed before reaching a customer, breach counsel, or other stakeholder.
• Lead case handovers for assigned engagements, ensuring a complete, clear transfer of status when work moves across regions.
• Mentor Analysts on technical methodology, evidence handling, and investigative best practices.
• Manage triage and analysis in high-pressure, large-scale incidents, maintaining composure and…