Staff Security Researcher- Detection AI Research - Sentinellabs

Research attack techniques and TTPs and how they manifest in our EDR telemetry, and turn that research into detection hypotheses that hold across millions of endpoints. Design, build, own, and maintain AI-powered detections end to end: turn a detection hypothesis into a production pipeline that analyzes fleet-wide EDR data, applies the team's ML models and LLMs to separate real intrusions from benign activity, and surfaces advanced attacks that analysts and threat hunters can triage and act on. Drive the development of LLM-based agents that automate detection authoring: define what a correct, robust detection looks like, and expand our agent's detection coverage autonomously. Analyze detection gaps and false positives together with MDR analysts, threat hunters and detection engineering teams, and feed the findings back into the detections. Write high-quality production Python and own your code in production. Stay current with APTs, attacker methodologies, and emerging TTPs. 5+ years of experience in security research, threat hunting, or detection engineering, with a track record of detections deployed in production. Deep understanding of the cybersecurity landscape, attack vectors, TTPs, and detection methods, especially on Windows. In-depth knowledge of Windows internals and of how attacker behavior appears in EDR telemetry: process, file, registry, and network events. Comfortable researching and hunting over very large telemetry datasets using SQL, KQL, Splunk, EDR query languages, or similar. Python software development experience, including working with data and writing production-quality code. Ability to drive and own research projects end to end; independent, critical thinker, team player. Interest in applying machine learning and LLMs to detection, and fluency with modern AI tools in your daily work Hands-on experience applying machine learning or LLMs to security problems. Experience writing detection content: behavioral rules, Sigma, YARA, EDR query languages. Malware analysis, reverse engineering, or red-team experience. Experience with EDR/XDR products and their telemetry. Restricted Stock Units (RSUs) Employee Stock Purchase Plan (ESPP) Competitive leave benefits Gender-neutral parental leave Employee Assistant Program Workout sessions and a Wellness App Medical and insurance benefits Pension Employee Assistance Program (EAP) Global home office allowance Mobile phone reimbursement Study Fund

Research attack techniques and TTPs and how they manifest in our EDR telemetry, and turn that research into detection hypotheses that hold across millions of endpoints. Design, build, own, and maintain AI-powered detections end to end: turn a detection hypothesis into a production pipeline that analyzes fleet-wide EDR data, applies the team's ML models and LLMs to separate real intrusions from benign activity, and surfaces advanced attacks that analysts and threat hunters can triage and act on. Drive the development of LLM-based agents that automate detection authoring: define what a correct, robust detection looks like, and expand our agent's detection coverage autonomously. Analyze detection gaps and false positives together with MDR analysts, threat hunters and detection engineering teams, and feed the findings back into the detections. Write high-quality production Python and own your code in production. Stay current with APTs, attacker methodologies, and emerging TTPs. 5+ years of experience in security research, threat hunting, or detection engineering, with a track record of detections deployed in production. Deep understanding of the cybersecurity landscape, attack vectors, TTPs, and detection methods, especially on Windows. In-depth knowledge of Windows internals and of how attacker behavior appears in EDR telemetry: process, file, registry, and network events. Comfortable researching and hunting over very large telemetry datasets using SQL, KQL, Splunk, EDR query languages, or similar. Python software development experience, including working with data and writing production-quality code. Ability to drive and own research projects end to end; independent, critical thinker, team player. Interest in applying machine learning and LLMs to detection, and fluency with modern AI tools in your daily work Hands-on experience applying machine learning or LLMs to security problems. Experience writing detection content: behavioral rules, Sigma, YARA, EDR query languages. Malware analysis, reverse engineering, or red-team experience. Experience with EDR/XDR products and their telemetry. Restricted Stock Units (RSUs) Employee Stock Purchase Plan (ESPP) Competitive leave benefits Gender-neutral parental leave Employee Assistant Program Workout sessions and a Wellness App Medical and insurance benefits Pension Employee Assistance Program (EAP) Global home office allowance Mobile phone reimbursement Study Fund

Research attack techniques and TTPs and how they manifest in our EDR telemetry, and turn that research into detection hypotheses that hold across millions of endpoints. Design, build, own, and maintain AI-powered detections end to end: turn a detection hypothesis into a production pipeline that analyzes fleet-wide EDR data, applies the team's ML models and LLMs to separate real intrusions from benign activity, and surfaces advanced attacks that analysts and threat hunters can triage and act on. Drive the development of LLM-based agents that automate detection authoring: define what a correct, robust detection looks like, and expand our agent's detection coverage autonomously. Analyze detection gaps and false positives together with MDR analysts, threat hunters and detection engineering teams, and feed the findings back into the detections. Write high-quality production Python and own your code in production. Stay current with APTs, attacker methodologies, and emerging TTPs. 5+ years of experience in security research, threat hunting, or detection engineering, with a track record of detections deployed in production. Deep understanding of the cybersecurity landscape, attack vectors, TTPs, and detection methods, especially on Windows. In-depth knowledge of Windows internals and of how attacker behavior appears in EDR telemetry: process, file, registry, and network events. Comfortable researching and hunting over very large telemetry datasets using SQL, KQL, Splunk, EDR query languages, or similar. Python software development experience, including working with data and writing production-quality code. Ability to drive and own research projects end to end; independent, critical thinker, team player. Interest in applying machine learning and LLMs to detection, and fluency with modern AI tools in your daily work Hands-on experience applying machine learning or LLMs to security problems. Experience writing detection content: behavioral rules, Sigma, YARA, EDR query languages. Malware analysis, reverse engineering, or red-team experience. Experience with EDR/XDR products and their telemetry. Restricted Stock Units (RSUs) Employee Stock Purchase Plan (ESPP) Competitive leave benefits Gender-neutral parental leave Employee Assistant Program Workout sessions and a Wellness App Medical and insurance benefits Pension Employee Assistance Program (EAP) Global home office allowance Mobile phone reimbursement Study Fund