Threat Detection Engineering Manager

As a Threat Detection Engineering Manager you will be tasked with leading a team of engineers that builds and ships the Windows agent’s behavioral detection and prevention capabilities, from low-level telemetry and in-memory traps to detection logic running on tens of millions of endpoints. Your team combines deep Windows internals knowledge, attacker tradecraft, behavioral analysis, and machine learning to stop sophisticated attacks before they cause harm.

You will join a growing team of passionate security engineers who think differently, challenge assumptions, and constantly explore new ways to outsmart adversaries. This is a hands-on technical role focused on security leadership, not general software engineering management.

What Will You Do?

Primary responsibilities include: 

• You will manage a team of detection engineers who build Windows behavioral detections and the infrastructure that runs them.
• You will own the design and delivery of behavioral detection and prevention engines in the Windows agent of SentinelOne’s Endpoint Protection platform, from low-level telemetry and in-memory traps to the detection logic running in production. Your team’s work doesn’t end with a hypothesis or a document - it ships in the product.
• Your team’s deliverables protect tens of millions of Windows endpoints running our platform.
• You will hire, grow, and lead the team, own the Windows detection roadmap, and own detection quality metrics (efficacy, false positives, performance impact).
• You will lead the team in building attack tools, PoCs, and attack simulations to validate and harden detections, and in finding new ways to detect and prevent exploitation (EoP, drive-by attacks, and more).
• You will work closely with SentinelOne’s research teams and with the agent and platform engineering teams, turning emerging attacker techniques into product-grade detections.
• This is a hands-on technical leadership role: you will stay close to the work, reviewing designs, detections, and code.

What Skills and Knowledge Will You Bring?

• Must-have: 5+ years of hands-on security experience, such as detection engineering, EDR/AV development, malware analysis, or offensive security
• Must-have: Deep understanding of Windows internals - processes and threads, memory management, handles and tokens, the loader, and kernel mechanisms such as callbacks, minifilters, and ETW
• Must-have: Hands-on experience writing behavioral detections for low-level malicious techniques and measuring their efficacy (true/false positives, resistance to evasion)
• Must-have: Working knowledge of attacker tradecraft - injection, credential theft, privilege escalation, defense evasion, LOLBins - and frameworks such as MITRE ATT&CK
• Must-have: Ability to read and write code (C/C++ preferred, plus a scripting language)
• Highly preferred: 2+ years leading detection or security engineers, as a manager or tech lead
• An advantage: AV/EDR internals, exploit development, ML-assisted detection, or published security research (talks, CVEs, blogs)

Why SentinelOne?

AI is redefining how the world operates and rewriting the rules of security in real time, and SentinelOne was built for this moment. From day one, we architected an AI-native platform designed to operate at machine speed, not as an add-on to legacy systems but as the foundation itself. If you want to build where innovation and impact move together, this is that place.

We invest in our Sentinels with comprehensive, competitive benefits designed to support you and your family:

Equity & Rewards

• Restricted Stock Units (RSUs)
• Employee Stock Purchase Plan (ESPP)

Time Off & Wellbeing

• Competitive leave benefits
• Gender-neutral parental leave
• Employee Assistant Program
• Workout sessions and a Wellness App

Insurance & Financial Security

• Medical and insurance benefits
• Pension
• Employee Assistance Program (EAP)

Work Perks & Flexibility

• Global home office allowance
• Mobile phone reimbursement
• Study Fund