Accountabilities:

SentinelOne Platform Administration

Lead the day-to-day administration and management of SentinelOne across multiple managed environments.
Oversee endpoint agent deployment, configuration, policy management, and overall fleet health.
Ensure consistent platform performance, security coverage, and operational reliability.

SIEM Operations and Optimization

Manage and continuously optimize SentinelOne's SIEM capabilities, including centralized log ingestion, management, correlation rules, dashboards, and alerting.
Improve detection coverage while reducing false positives and unnecessary security alerts.
Ensure effective log analysis and monitoring to support proactive threat identification.

Detection Engineering and Tuning

Design, configure, test, and refine endpoint detection and response policies.
Develop and optimize Deep Visibility and Storyline queries to identify suspicious activities and emerging threats.
Continuously improve detection capabilities to address evolving cybersecurity risks while minimizing unnecessary analyst workload.

Incident Response and Threat Investigation

Support the triage, investigation, and remediation of threats identified through the SentinelOne platform.
Conduct threat hunting activities and root-cause analysis to identify security incidents and potential vulnerabilities.
Recommend and implement appropriate remediation strategies to strengthen endpoint and organizational security.

Systems Integration

Integrate SentinelOne with SIEM, Security Orchestration, Automation and Response (SOAR), ticketing systems, and other enterprise security technologies.
Ensure seamless data exchange, centralized visibility, and efficient security workflows across integrated platforms.

Performance Monitoring and Lifecycle Management

Monitor endpoint agent health, policy coverage, and overall platform performance.
Identify security gaps and implement corrective actions across managed environments.
Manage platform upgrades, policy version control, and lifecycle changes while minimizing operational disruption.

Governance and Compliance

Ensure SentinelOne operations align with applicable regulatory and security requirements, including NIST SP 800-53 and Zero Trust principles.
Support compliance with state-specific security requirements and other relevant governance standards.
Maintain operational practices that promote secure, consistent, and auditable endpoint protection.

Reporting and Client Collaboration

Prepare technical reports covering endpoint health, SIEM performance, detection capabilities, and security optimization outcomes.
Provide actionable recommendations to improve security posture and operational effectiveness.
Engage with clients and stakeholders throughout project and service delivery activities, including state government customers where applicable.

Technical Leadership and Mentoring

Coach and mentor junior engineers on SentinelOne administration, detection engineering, and cybersecurity best practices.
Share technical expertise and contribute to continuous improvements in engineering processes and security operations.

Requirements

Current SentinelOne Certified Engineer certification is mandatory.
At least 3–5 years of professional experience in endpoint security, detection engineering, or Security Operations Center (SOC) operations.
Substantial hands-on experience administering, managing, and optimizing SentinelOne in production environments.
Demonstrated experience operating and continuously improving SentinelOne as a SIEM platform, including log management, correlation rules, and alert tuning.
Strong technical knowledge of Endpoint Detection and Response (EDR) and Extended Detection and Response (XDR) technologies.
Practical experience with endpoint security policy configuration, Deep Visibility and Storyline queries, and threat hunting workflows.
Experience integrating EDR and SIEM platforms with SOAR solutions, ticketing systems, and broader enterprise security tools.
Familiarity with NIST SP 800-53, Zero Trust architecture principles, and general cybersecurity governance and compliance frameworks.

How Jobgether works

We use an AI-powered matching process to ensure your application is reviewed quickly, objectively, and fairly against the role's core requirements. Our system identifies the top-fitting candidates, and this shortlist is then shared directly with the hiring company. The final decision and next steps (interviews, assessments) are managed by their internal team.

We appreciate your interest and wish you the best!

Why Apply Through Jobgether?

Data Privacy Notice: By submitting your application, you acknowledge that Jobgether will process your personal data to evaluate your candidacy and share relevant information with the hiring employer. This processing is based on legitimate interest and pre-contractual measures under applicable data protection laws (including GDPR). You may exercise your rights (access, rectification, erasure, objection) at any time.

#LI-CL1