SentinelOne Engineer (R-00249)

Position Overview
True Zero is seeking a Certified SentinelOne Engineer to lead the ongoing operations, tuning, and optimization of SentinelOne across secure, mission-critical environments — including use of the platform as a SIEM for centralized log management, detection, and correlation. This is a senior technical role for an engineer who pairs deep, hands-on SentinelOne expertise with the judgment to guide teams, engage clients, and deliver production-grade, highly reliable endpoint and SIEM operations. The ideal candidate holds current SentinelOne Certified Engineer status and brings a track record of running and continuously optimizing SentinelOne in production — tuning detection policies, managing the agent fleet, and operating SentinelOne’s SIEM capabilities for log ingestion, correlation, and alerting. Experience supporting state government customers is a strong plus, given True Zero’s growing work across SLED environments.

Key Responsibilities
Platform Operations: Own the day-to-day administration of SentinelOne across managed environments, including agent deployment, policy management, and fleet health. SIEM Operations & Optimization: Operate and continuously optimize SentinelOne’s SIEM capabilities — log ingestion, correlation rules, dashboards, and alerting — to maximize detection coverage and minimize false positives. Detection Engineering & Tuning: Design, tune, and validate detection policies and Deep Visibility/Storyline queries to keep pace with evolving threats while reducing analyst noise. Incident Response Support: Support triage, investigation, and remediation of SentinelOne-detected threats, including threat hunting and root-cause analysis. Systems Integration: Integrate SentinelOne with SIEM, SOAR, ticketing, and other security tooling to ensure seamless data flow and unified workflows. Performance & Health Monitoring: Monitor agent health, policy coverage, and platform performance; identify and remediate gaps across the managed fleet. Upgrades & Lifecycle Management: Manage SentinelOne upgrades, policy version control, and lifecycle changes with minimal operational disruption. Governance & Compliance: Ensure SentinelOne operations align with regulatory and security requirements, including NIST SP 800-53 and Zero Trust principles, and state-specific requirements where applicable. Reporting: Deliver technical reports on endpoint and SIEM health, detection posture, and tuning outcomes with clear, actionable recommendations. Client Collaboration: Engage with clients and stakeholders throughout the engagement lifecycle, including state government customers where assigned. Team Development: Coach and mentor junior engineers on SentinelOne operations and detection engineering best practices.

Qualification & Requirements
Certification: Must be a SentinelOne Certified Engineer (current certification required). Experience: Minimum of 3–5 years in endpoint security, detection engineering, or SOC operations, with substantial hands-on SentinelOne administration. SIEM Operations: Required: experience with the ongoing operations and optimization of SentinelOne as a SIEM platform, including log management, correlation, and alert tuning. Technical Proficiency: Hands-on experience with EDR/XDR administration, policy tuning, Deep Visibility/Storyline queries, and threat hunting workflows. Systems Integration: Experience integrating EDR/SIEM platforms with SOAR, ticketing, and broader security tooling. Governance: Familiarity with NIST SP 800-53, Zero Trust architecture principles, and general security compliance frameworks. Communication: Excellent written and verbal skills to convey technical information to diverse audiences. Education: Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related field preferred; equivalent experience considered. Preferred Experience Experience supporting state government (SLED) customers is a plus. Additional security certifications (e.g., Security+, CySA+, GCIH, or equivalent) are a plus. Experience with other EDR/SIEM platforms (e.g., Splunk, CrowdStrike) is a plus. Prior experience at a Veteran-Owned Small Business or similar government-focused contractor is a plus.