[Remote] Staff DFIR Investigator
Note: The job is a remote job and is open to candidates in USA. SentinelOne is redefining cybersecurity with AI-powered innovations. They are seeking a Staff DFIR Investigator to conduct digital forensic investigations and threat hunting operations for global clients, ensuring excellence in engagements and contributing to community-facing publications.
Responsibilities
- Accountable to ensure excellence in every engagement, to include scoping, forensic analysis, reporting, hunting, remediation consulting, and client communication.
- Analyze malware, exploits and other suspicious files from DFIR cases to add context and threat intelligence, including performing deep reverse engineering analysis to understand malware functionality and attack vectors.
- Perform oversight on identified IOCs and enrich context when necessary through comprehensive malware reverse engineering.
- Augment both the forensics processing pipeline and malware analysis infrastructure with new tools and scenarios to streamline reverse engineering workflows.
- Spearhead efforts to publish blogs on unique threats, relevant DFIR cases, and new forensic discoveries during incidents, with emphasis on malware reverse engineering findings.
- Contribute as a lead investigator for engagements. Manage all aspects of a breach response and containment investigation.
- Technical investigative skills must include host-based forensic analysis, EDR-driven incident response, malware analysis, memory analytics, and network log investigations.
- Provide detailed and impactful formal investigative reports, to include technical findings and security improvement recommendations.
- Work closely with the threat intelligence team to pursue attribution, identify attack trends, innovative malicious TTPs, and contribute to community-facing publications and blogs.
Skills
- 4+ years of hands-on consulting experience in threat hunting, digital forensics, and incident response.
- Malware reverse engineering skills using tools such as IDA Pro, Ghidra, x64dbg, or similar disassemblers and debuggers.
- Proficiency in static and dynamic malware analysis techniques, including unpacking, deobfuscation, and behavioral analysis.
- Experience with scripting languages (Python, PowerShell) for automation of reverse engineering tasks and malware analysis workflows.
- Advanced experience conducting dynamic malware analysis in sandboxed environments and deep understanding of the complete reverse engineering process.
- Knowledge of various malware families, attack frameworks, and ability to identify new or modified variants through reverse engineering analysis.
- Understanding of Windows/Linux internals, assembly language, and common evasion techniques employed by modern malware.
- Experience with forensic investigative software.
- Experience with EDR/XDR platforms (SentinelOne preferred).
- Experience with memory analytics (Volatility Preferred).
- Experience or knowledge of conducting endpoint based threat hunting (compromise assessments).
- Experience working with cyber threat intelligence platforms and the threat intelligence process from raw attack data to finished intel and publications.
Benefits
- Medical, Vision, Dental, 401(k), Commuter, Health and Dependent FSA
- Unlimited PTO
- Industry leading gender-neutral parental leave
- Paid Company Holidays
- Paid Sick Time
- Employee stock purchase program
- Disability and life insurance
- Employee assistance program
- Gym membership reimbursement
- Cell phone reimbursement
- Numerous company-sponsored events including regular happy hours and team building events
Company Overview
- SentinelOne is an autonomous cybersecurity solution company. It was founded in 2013, and is headquartered in Mountain View, California, USA, with a workforce of 1001-5000 employees. Its website is http://www.sentinelone.com.
Company H1B Sponsorship
- SentinelOne has a track record of offering H1B sponsorships, with 10 in 2025, 14 in 2024, 2 in 2023, 18 in 2022, 5 in 2021. Please note that this does not guarantee sponsorship for this specific role.
Apply tot his job Apply To this Job