SentinelOne Engineer (R-00249)

Position Overview True Zero is seeking a Certified SentinelOne Engineer to lead the ongoing operations, tuning, and optimization of SentinelOne across secure, mission-critical environments — including use of the platform as a SIEM for centralized log management, detection, and correlation. This is a senior technical role for an engineer who pairs deep, hands-on SentinelOne expertise with the judgment to guide teams, engage clients, and deliver production-grade, highly reliable endpoint and SIEM operations.

The ideal candidate holds current SentinelOne Certified Engineer status and brings a track record of running and continuously optimizing SentinelOne in production — tuning detection policies, managing the agent fleet, and operating SentinelOne’s SIEM capabilities for log ingestion, correlation, and alerting. Experience supporting state government customers is a strong plus, given True Zero’s growing work across SLED environments.

Key Responsibilities • Platform Operations: Own the day-to-day administration of SentinelOne across managed environments, including agent deployment, policy management, and fleet health.

• SIEM Operations & Optimization: Operate and continuously optimize SentinelOne’s SIEM capabilities — log ingestion, correlation rules, dashboards, and alerting — to maximize detection coverage and minimize false positives.

• Detection Engineering & Tuning: Design, tune, and validate detection policies and Deep Visibility/Storyline queries to keep pace with evolving threats while reducing analyst noise.

• Incident Response Support: Support triage, investigation, and remediation of SentinelOne-detected threats, including threat hunting and root-cause analysis.

• Systems Integration: Integrate SentinelOne with SIEM, SOAR, ticketing, and other security tooling to ensure seamless data flow and unified workflows.

• Performance & Health Monitoring: Monitor agent health, policy coverage, and platform performance; identify and remediate gaps across the managed fleet.

• Upgrades & Lifecycle Management: Manage SentinelOne upgrades, policy version control, and lifecycle changes with minimal operational disruption.

• Governance & Compliance: Ensure SentinelOne operations align with regulatory and security requirements, including NIST SP 800-53 and Zero Trust principles, and state-specific requirements where applicable.

• Reporting: Deliver technical reports on endpoint and SIEM health, detection posture, and tuning outcomes with clear, actionable recommendations.

• Client Collaboration: Engage with clients and stakeholders throughout the engagement lifecycle, including state government customers where assigned.

• Team Development: Coach and mentor junior engineers on SentinelOne operations and detection engineering best practices.

Qualification & Requirements • Certification: Must be a SentinelOne Certified Engineer (current certification required).

• Experience: Minimum of 3–5 years in endpoint security, detection engineering, or SOC operations, with substantial hands-on SentinelOne administration.

• SIEM Operations: Required: experience with the ongoing operations and optimization of SentinelOne as a SIEM platform, including log management, correlation, and alert tuning.

• Technical Proficiency: Hands-on experience with EDR/XDR administration, policy tuning, Deep Visibility/Storyline queries, and threat hunting workflows.

• Systems Integration: Experience integrating EDR/SIEM platforms with SOAR, ticketing, and broader security tooling.

• Governance: Familiarity with NIST SP 800-53, Zero Trust architecture principles, and general security compliance frameworks.

• Communication: Excellent written and verbal skills to convey technical information to diverse audiences.

• Education: Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related field preferred; equivalent experience considered.

Preferred Experience

• Experience supporting state government (SLED) customers is a plus.

• Additional security certifications (e.g., Security+, CySA+, GCIH, or equivalent) are a plus.

• Experience with other EDR/SIEM platforms (e.g., Splunk, CrowdStrike) is a plus.

• Prior experience at a Veteran-Owned Small Business or similar government-focused contractor is a plus.