Threat Detection Engineering Manager

The role

You will lead a team of engineers building Windows agent behavioral detection and prevention capabilities. This hands-on technical leadership role involves owning the Windows detection roadmap and designing detection engines for the Endpoint Protection platform.

What you will do

• Manage a team of detection engineers building Windows behavioral detections and infrastructure.
• Own the design and delivery of behavioral detection and prevention engines in the Windows agent.
• Hire, grow, and lead the team.
• Own the Windows detection roadmap and detection quality metrics.
• Lead the team in building attack tools, PoCs, and attack simulations.
• Work with research, agent, and platform engineering teams to turn attacker techniques into detections.
• Review designs, detections, and code.

Required qualifications

• 5+ years of hands-on security experience, such as detection engineering, EDR/AV development, malware analysis, or offensive security
• Deep understanding of Windows internals - processes and threads, memory management, handles and tokens, the loader, and kernel mechanisms such as callbacks, minifilters, and ETW
• Hands-on experience writing behavioral detections for low-level malicious techniques and measuring their efficacy
• Working knowledge of attacker tradecraft - injection, credential theft, privilege escalation, defense evasion, LOLBins - and frameworks such as MITRE ATT&CK
• Ability to read and write code (C/C++ preferred, plus a scripting language)

Nice to have

• 2+ years leading detection or security engineers, as a manager or tech lead
• AV/EDR internals
• exploit development
• ML-assisted detection
• published security research (talks, CVEs, blogs)

Benefits

• Restricted Stock Units (RSUs)
• Employee Stock Purchase Plan (ESPP)
• Competitive leave benefits
• Gender-neutral parental leave
• Employee Assistant Program
• Workout sessions and a Wellness App
• Medical and insurance benefits
• Pension
• Global home office allowance
• Mobile phone reimbursement
• Study Fund

About the company

SentinelOne is a company at the intersection of AI and security, pioneering a new operating model for cybersecurity. Their AI-native platform unifies protection across endpoint, cloud, identity, data, and AI systems.