Senior Security Researcher - AI Detection

The role

You will join the Detection AI Research team to research attack techniques and TTPs using EDR telemetry. You will design, build, and maintain AI-powered detections and LLM-based agents to separate real intrusions from benign activity.

What you will do

• Research attack techniques and TTPs and how they manifest in EDR telemetry.
• Turn research into detection hypotheses that hold across millions of endpoints.
• Design, build, own, and maintain AI-powered detections end to end.
• Turn detection hypotheses into production pipelines using ML models and LLMs.
• Drive the development of LLM-based agents that automate detection authoring.
• Analyze detection gaps and false positives with MDR analysts, threat hunters and detection engineering teams.
• Write high-quality production Python and own code in production.
• Stay current with APTs, attacker methodologies, and emerging TTPs.

Required qualifications

• 5+ years of experience in security research, threat hunting, or detection engineering.
• Track record of detections deployed in production.
• Deep understanding of the cybersecurity landscape, attack vectors, TTPs, and detection methods, especially on Windows.
• In-depth knowledge of Windows internals and how attacker behavior appears in EDR telemetry: process, file, registry, and network events.
• Comfortable researching and hunting over very large telemetry datasets using SQL, KQL, Splunk, EDR query languages, or similar.
• Python software development experience, including working with data and writing production-quality code.
• Ability to drive and own research projects end to end.
• Independent, critical thinker, team player.
• Interest in applying machine learning and LLMs to detection.
• Fluency with modern AI tools in daily work.

Nice to have

• Hands-on experience applying machine learning or LLMs to security problems.
• Experience writing detection content: behavioral rules, Sigma, YARA, EDR query languages.
• Malware analysis, reverse engineering, or red-team experience.
• Experience with EDR/XDR products and their telemetry.

Benefits

• Restricted Stock Units (RSUs)
• Employee Stock Purchase Plan (ESPP)
• Competitive leave benefits
• Gender-neutral parental leave
• Employee Assistant Program
• Workout sessions and a Wellness App
• Medical and insurance benefits
• Pension
• Global home office allowance
• Mobile phone reimbursement
• Study Fund

About the company

SentinelOne is a company at the intersection of AI and security. Their AI-native platform unifies protection across endpoint, cloud, identity, data, and AI systems.