Threat Detection Engineering Manager

Our Purpose

At SentinelOne, we are driven by a clear purpose: to give the advantage to those who secure our future. As AI reshapes how organizations build, operate, and innovate, the responsibility to protect them becomes more critical than ever. When you join SentinelOne, your work helps protect global enterprises, critical infrastructure, and the technologies shaping tomorrow. If you are motivated by meaningful challenges and want your impact to be real, measurable, and global, you will find purpose here.

About Us

SentinelOne is a company at the intersection of AI and security, pioneering a new operating model for cybersecurity. Our AI-native platform unifies protection across endpoint, cloud, identity, data, and AI systems to deliver autonomous detection and response with clarity and speed. By combining real-time analytics, intelligent automation, and a unified data foundation, we reduce noise, simplify complexity, and empower security teams to focus on what truly matters.

Our teams are builders, problem-solvers, and innovators committed to shaping the future of security. If you are excited to solve hard problems alongside talented, mission-driven people, we invite you to help us build a safer future for humanity.

What Are We Looking For?

We’re looking for people who are relentlessly curious and committed to continuous learning. AI is reshaping every function across our business, and we enable every team member, regardless of role or level, to build fluency in AI tools and concepts. Those who thrive here actively seek out new solutions, experiment thoughtfully, and apply what they learn to drive better, faster, smarter outcomes.

As a Threat Detection Engineering Manager you will be tasked with leading a team of engineers that builds and ships the Windows agent’s behavioral detection and prevention capabilities, from low-level telemetry and in-memory traps to detection logic running on tens of millions of endpoints. Your team combines deep Windows internals knowledge, attacker tradecraft, behavioral analysis, and machine learning to stop sophisticated attacks before they cause harm.

You will join a growing team of passionate security engineers who think differently, challenge assumptions, and constantly explore new ways to outsmart adversaries. This is a hands-on technical role focused on security leadership, not general software engineering management.

What Will You Do?

Primary responsibilities include :

• You will manage a team of detection engineers who build Windows behavioral detections and the infrastructure that runs them.

• You will own the design and delivery of behavioral detection and prevention engines in the Windows agent of SentinelOne’s Endpoint Protection platform, from low-level telemetry and in-memory traps to the detection logic running in production. Your team’s work doesn’t end with a hypothesis or a document - it ships in the product.

• Your team’s deliverables protect tens of millions of Windows endpoints running our platform.

• You will hire, grow, and lead the team, own the Windows detection roadmap, and own detection quality metrics (efficacy, false positives, performance impact).

• You will lead the team in building attack tools, PoCs, and attack simulations to validate and harden detections, and in finding new ways to detect and prevent exploitation (EoP, drive-by attacks, and more).

• You will work closely with SentinelOne’s research teams and with the agent and platform engineering teams, turning emerging attacker techniques into product-grade detections.

• This is a hands-on technical leadership role: you will stay close to the work, reviewing designs, detections, and code.

What Skills and Knowledge Will You Bring?

• Must-have: 5+ years of hands-on security experience, such as detection engineering, EDR/AV development, malware analysis, or offensive security

• Must-have: Deep understanding of Windows internals - processes and threads, memory management, handles and tokens, the loader, and kernel mechanisms such as callbacks, minifilters, and ETW

• Must-have: Hands-on experience writing behavioral detections for low-level malicious techniques and measuring their efficacy (true/false positives, resistance to evasion)

• Must-have: Working knowledge of attacker tradecraft - injection, credential theft, privilege escalation, defense evasion, LOLBins - and frameworks such as MITRE ATT&CK

• Must-have: Ability to read and write code (C/C++ preferred, plus a scripting language)

• Highly preferred: 2+ years leading detection or security engineers, as a manager or tech lead

• An advantage: AV/EDR internals, exploit development, ML-assisted detection, or published security research (talks, CVEs, blogs)

Why SentinelOne?

AI is redefining how the world operates and rewriting the rules of security in real time, and SentinelOne was built for this moment. From day one, we architected an AI-native platform designed to operate at machine speed, not as an add-on to legacy systems but as the foundation itself. If you want to build where innovation and impact move together, this is that place.

We invest in our Sentinels with comprehensive, competitive benefits designed to support you and your family:

Equity & Rewards

• Restricted Stock Units (RSUs)

• Employee Stock Purchase Plan (ESPP)

Time Off & Wellbeing

• Competitive leave benefits

• Gender-neutral parental leave

• Employee Assistant Program

• Workout sessions and a Wellness App

Insurance & Financial Security

• Medical and insurance benefits

• Pension

• Employee Assistance Program (EAP)

Work Perks & Flexibility

• Global home office allowance

• Mobile phone reimbursement

• Study Fund

SentinelOne is proud to be an Equal Employment Opportunity and Affirmative Action employer. We do not discriminate based upon race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics.

SentinelOne participates in the E-Verify Program for all U.S. based roles.

To learn more about how we use AI in our hiring process, please review our AI in Hiring Candidate Disclosure .