Staff Security Researcher- Detection AI Research
About this role
Relentlessly curious security professionals who enjoy exploring complex attack techniques and applying modern artificial intelligence to threat detection will thrive in this environment. SentinelOne operates at the intersection of security and machine learning, uniting endpoint, cloud, and AI systems to deliver autonomous detection at scale. Within the Detection AI Research team, you will bridge the gap between adversarial techniques and data science by analyzing massive telemetry datasets to surface sophisticated intrusions.
Your day-to-day work involves investigating how advanced threats manifest in endpoint telemetry and translating those insights into production-grade detection pipelines. You will collaborate closely with data scientists and threat hunters to design machine learning models and large language model agents that automate detection authoring and separate real attacks from benign noise. This role exists to strengthen defenses against evolving adversaries using cutting-edge automation, making it an ideal fit for someone with deep Windows internals knowledge and a passion for production-quality Python development.
What you will do
- Research attack techniques and Tactics, Techniques, and Procedures to understand how they manifest in endpoint detection and response telemetry.
- Design and build end-to-end AI-powered detection pipelines that analyze fleet-wide data and apply machine learning models to surface advanced attacks.
- Drive the development of large language model agents that autonomously define robust detections and expand coverage.
- Analyze detection gaps and false positives in partnership with managed detection and response analysts and threat hunters.
- Write high-quality production Python code and maintain ownership of detection components in production environments.
- Stay current with advanced persistent threats, emerging attacker methodologies, and evolving security vectors.
What you need
- Candidates must have five or more years of experience in security research, threat hunting, or detection engineering, with a track record of production-deployed detections.
- A deep understanding of the cybersecurity landscape, attack vectors, and detection methods, particularly on the Windows operating system, is required.
- Applicants need in-depth knowledge of Windows internals and how malicious behavior appears in telemetry events such as process, file, registry, and network actions.
- Familiarity with researching and hunting over very large telemetry datasets using query tools like SQL, KQL, or Splunk is necessary.
- Demonstrated software development experience in Python, including working with data and writing production-quality code, is essential.
Nice to have
- Hands-on experience applying machine learning or large language models to security problems
- Experience writing detection content including behavioral rules, Sigma, YARA, or EDR query languages
- Malware analysis, reverse engineering, or red-team experience
- Experience with endpoint detection and response or extended detection and response products and their telemetry
Benefits
- Restricted Stock Units and Employee Stock Purchase Plan
- Competitive leave benefits and gender-neutral parental leave
- Employee Assistance Program, workout sessions, and a wellness app
- Medical and insurance benefits along with a pension
- Global home office allowance and mobile phone reimbursement
- Study fund
Skills and tech stack
Questions candidates ask
What will I actually work on in the Detection AI Research team?
You will hunt for sophisticated attacks using EDR telemetry from millions of endpoints, design ML models and LLM-based agents, and turn research into production pipelines that surface advanced threats for analysts.
What kind of technical background is required for this role?
You need over five years of experience in security research, threat hunting, or detection engineering, alongside deep knowledge of Windows internals, large-scale telemetry querying, and production Python development.
How do team members collaborate across different functions?
You will work directly alongside data scientists who build models, as well as MDR analysts, threat hunters, and detection engineering teams to analyze detection gaps and feed findings back into the system.
What perks and financial benefits are provided?
The company offers restricted stock units, an employee stock purchase plan, medical and insurance benefits, a pension, a global home office allowance, mobile phone reimbursement, and a study fund.