SentinelOne Engineer (R-00249)

True Zero Technologies is seeking a SentinelOne Engineer to lead the operation, tuning, and optimization of SentinelOne in secure, mission-critical environments. The role includes managing endpoint and SIEM capabilities, supporting incident response, integrating security tools, and guiding clients and junior engineers.

Responsibilities:

• Own the day-to-day administration of SentinelOne across managed environments, including agent deployment, policy management, and fleet health
• Operate and continuously optimize SentinelOne’s SIEM capabilities — log ingestion, correlation rules, dashboards, and alerting — to maximize detection coverage and minimize false positives
• Design, tune, and validate detection policies and Deep Visibility/Storyline queries to keep pace with evolving threats while reducing analyst noise
• Support triage, investigation, and remediation of SentinelOne-detected threats, including threat hunting and root-cause analysis
• Integrate SentinelOne with SIEM, SOAR, ticketing, and other security tooling to ensure seamless data flow and unified workflows
• Monitor agent health, policy coverage, and platform performance; identify and remediate gaps across the managed fleet
• Manage SentinelOne upgrades, policy version control, and lifecycle changes with minimal operational disruption
• Ensure SentinelOne operations align with regulatory and security requirements, including NIST SP 800-53 and Zero Trust principles, and state-specific requirements where applicable
• Deliver technical reports on endpoint and SIEM health, detection posture, and tuning outcomes with clear, actionable recommendations
• Engage with clients and stakeholders throughout the engagement lifecycle, including state government customers where assigned
• Coach and mentor junior engineers on SentinelOne operations and detection engineering best practices

Requirements:

• Must be a SentinelOne Certified Engineer (current certification required)
• Minimum of 3–5 years in endpoint security, detection engineering, or SOC operations, with substantial hands-on SentinelOne administration
• Required: experience with the ongoing operations and optimization of SentinelOne as a SIEM platform, including log management, correlation, and alert tuning
• Hands-on experience with EDR/XDR administration, policy tuning, Deep Visibility/Storyline queries, and threat hunting workflows
• Experience integrating EDR/SIEM platforms with SOAR, ticketing, and broader security tooling
• Familiarity with NIST SP 800-53, Zero Trust architecture principles, and general security compliance frameworks
• Excellent written and verbal skills to convey technical information to diverse audiences
• Bachelor's degree in Computer Science, Cybersecurity, Information Technology, or a related field preferred
• equivalent experience considered
• Experience supporting state government (SLED) customers is a plus
• Additional security certifications (e.g., Security+, CySA+, GCIH, or equivalent) are a plus
• Experience with other EDR/SIEM platforms (e.g., Splunk, CrowdStrike) is a plus
• Prior experience at a Veteran-Owned Small Business or similar government-focused contractor is a plus