Threat Hunter, SentinelOne
$84-110k
Offers Restricted Stock Program and ESP
Autonomous cybersecurity platform
Be an early applicant
Autonomous cybersecurity platform
1001+ employees
Be an early applicant
$84-110k
Offers Restricted Stock Program and ESP
1001+ employees
Company mission
To defeat every attack, every second, of every day.
Role
Who you are
- We’re looking for people who are relentlessly curious and committed to continuous learning
- 3+ years in security operations and/or adjacent disciplines (threat hunting, incident response, DFIR, malware analysis, SOC, or penetration testing)
- Strong familiarity with EDR telemetry (process, file, network, persistence)—SentinelOne experience is a plus
- Proficiency with Python and Git/GitHub workflows (branches, PRs, code review); ability to turn hunt logic into robust, reusable code
- Broad OS internals knowledge across Windows, Linux, and macOS
- Applied CTI skills: consume and operationalize IOCs/TTPs; track actors/campaigns; pivot with OSINT to enrich hunts
- Experience collaborating with cross-functional teams (MDR, IR, Labs, Detection Engineering) to cycle from research → hunt → detection → outcome
- Clear, concise writing and reporting for client-facing communications (advisories, AARs, executive summaries), and comfort presenting technical analysis directly to clients when necessary
- Familiarity with MITRE ATT&CK and mapping hunts to relevant techniques
- U.S. citizenship required due to FedRAMP program requirements
What the job involves
- AI is reshaping every function across our business, and we enable every team member, regardless of role or level, to build fluency in AI tools and concepts
- Those who thrive here actively seek out new solutions, experiment thoughtfully, and apply what they learn to drive better, faster, smarter outcomes
- As an experienced threat hunter, you will be tasked with delivering SentinelOne’s proactive threat hunting services to our Threat Hunting clients (including FedRAMP-authorized environments)
- You’ll build and maintain a high-quality library of hunts and rules across Windows, macOS, and Linux, with a strong emphasis on EDR telemetry (bonus if you know SentinelOne deeply)
- You’ll partner closely with MDR, Incident Response, Labs, and Detection Engineering to respond to emerging threats, convert research into actionable hunts, and communicate clearly with clients
- Design, implement, and continuously improve a structured library of hypothesis-driven hunts and reusable rules aligned with the ATT&CK framework
- Execute proactive hunts across diverse telemetry (primarily EDR) to uncover malicious activity such as living-off-the-land techniques and stealthy persistence
- Carry out all threat hunting activities in controlled FedRAMP environments
- Translate findings into repeatable playbooks, automations, and platform-ready detections where applicable
- Triage emerging threats (e.g. zero-days) and assess potential exposure
- Build focused hunts and detections mapped to relevant TTPs, with clear rationale and validation steps
- Produce concise, actionable client advisories explaining scope and potential impact of the emerging threat, recommended mitigations, and the steps being taken by SentinelOne to protect our customers
- Partner with Detection Engineering, MDR, Labs, and CTI to evaluate and tune rules for fidelity and coverage
- Curate and operationalize relevant IOCs/TTPs from CTI, Labs research, and OSINT into hunts and when appropriate convert those into platform detections
Our take
Cybercriminals are now leveraging the power of automation to make the current threat landscape too advanced for a lot of legacy antivirus software. SentinelOne is a cybersecurity company that matches this automation with machine learning-focused software designed to help businesses defend against online attacks.
The company expanded the scope of its business from the endpoint security market to three markets valued at a combined $30 billion, including the corporate endpoint security and IT operations management markets. This gives SentinelOne a bigger potential customer base, although it also puts them in direct competition with more focused cybersecurity companies, in addition to its biggest competitor, CrowdStrike.
When the company went public in 2021, it made financial headlines as the highest-valued cybersecurity IPO ever, which gave SentinelOne a market capitalisation of $10 billion. However, it's since fallen to around $ 4 billion. It has subsequently launched S Ventures, a $100M fund, through which SentinelOne invests in cybersecurity startups and has expanded its partnership with major tax firm KPMG to accelerate cyber investigations and responses to threats.
Steph
Company Specialist at Welcome to the Jungle
Insights
61% employee growth in 12 months
Company
Funding (last 2 of 9 rounds)
Feb 2021
$100m
LATE VC
Nov 2020
$267m
LATE VC
Total funding: $801.2m
Company benefits
- Incentive-based Wellness Challenges
- Medical, Dental & Vision
- Gym Reimbursement
- Career Wellness Perks
- Mental Health & Mindfulness
- Paid Parental Leave
- 401k
- Flexible Spending Accounts
- Short & Long Term Disability Insurance
- Employee Assistance Program
- Life Insurance
- Unlimited Time Off
- Paid Sick Time
- Paid Holidays
- Happy Hours
- Parties & Celebrations
- Team Building Activities
- All-Hands & Town Hall Gatherings
Company HQ
Old Mountain View, Mountain View, CA
Leadership
Tomer Weingarten
(Co-Founder & CEO)They started their career in Software Development at Mckit Systems prior to co-founding dPolls and Carambola Media. They left their position as VP of Products at Toluna in December 2012 to found SentinelOne in January 2013, where they serve as CEO.
Share this job
View 29 more jobs at SentinelOne