Staff Security Researcher- Detection AI Research
About this role
Defending global enterprises against sophisticated, highly evasive attacks requires bridging the gap between raw endpoint telemetry and autonomous machine learning systems. SentinelOne seeks a Staff Security Researcher for their Detection AI Research team in Tel Aviv-Yafo to tackle the challenge of closing critical coverage gaps using advanced ML models and production-grade LLM agents.
Working at the intersection of security research and machine learning, this individual brings an attacker's-eye view to analyze TTPs and determine what separates real intrusions from benign noise at scale. They collaborate closely with data scientists to design, build, and maintain end-to-end AI-powered detection pipelines that process fleet-wide endpoint data and surface advanced threats for human analysts.
Ideal candidates are relentlessly curious, independent thinkers with a strong background in security research, threat hunting, or detection engineering. Someone who thrives here enjoys diving deep into massive datasets, writing robust production Python code, and actively applying modern AI concepts to solve complex cybersecurity problems.
What you will do
- Investigate attack techniques and TTPs to formulate robust detection hypotheses across massive endpoint telemetry datasets.
- Design, build, and maintain end-to-end AI-powered detection pipelines utilizing machine learning models and large language models.
- Develop autonomous LLM-based agents that automate detection authoring and expand threat coverage.
- Analyze detection gaps and false positives in collaboration with MDR analysts, threat hunters, and detection engineering teams.
- Write high-quality production Python code and take ownership of deployed detection systems.
- Monitor and adapt to emerging APT methodologies and evolving attacker techniques.
What you need
- Minimum of 5 years of professional experience in security research, threat hunting, or detection engineering.
- Demonstrated track record of successfully deploying detection mechanisms into production environments.
- Comprehensive understanding of the cybersecurity landscape, attack vectors, TTPs, and detection methods with a focus on Windows.
- In-depth knowledge of Windows internals and how malicious behavior manifests within EDR telemetry across processes, files, registries, and networks.
- Proficiency in researching and hunting across large-scale telemetry datasets using SQL, KQL, Splunk, or EDR query languages.
- Practical Python software development experience focused on writing clean, production-grade code.
- Strong ability to drive research projects independently from inception to completion.
Nice to have
- Hands-on experience applying machine learning or LLMs to security problems
- Experience writing detection content such as behavioral rules, Sigma, YARA, or EDR queries
- Malware analysis, reverse engineering, or red-team experience
- Familiarity with EDR and XDR products and their underlying telemetry
Benefits
- Restricted Stock Units (RSUs) and Employee Stock Purchase Plan (ESPP)
- Competitive leave benefits and gender-neutral parental leave
- Medical and insurance benefits with pension options
- Global home office allowance and mobile phone reimbursement
- Study fund and wellness support including workout sessions and an Employee Assistance Program
Skills and tech stack
Questions candidates ask
What will I actually be working on in this role?
You will join the Detection AI Research team to hunt for sophisticated attacks using EDR telemetry from millions of endpoints. Your work involves building ML models and LLM-based agents that separate real intrusions from benign noise and surface advanced threats in production.
Who will I collaborate with day to day?
You will work alongside data scientists who build the models, as well as MDR analysts, threat hunters, and detection engineering teams. Your detections will directly reach real customers through Wayfinder analysts and threat hunting engines.
What kind of technical background is required?
Candidates need at least five years of experience in security research, threat hunting, or detection engineering, plus a deep understanding of Windows internals and EDR telemetry. Strong production Python development skills and familiarity with large telemetry datasets using SQL, KQL, or Splunk are also required.
What perks and financial benefits are included?
The company offers Restricted Stock Units, an Employee Stock Purchase Plan, and pension options alongside medical insurance. Additional perks include a global home office allowance, mobile phone reimbursement, a study fund, and wellness programs.