[Remote] Staff DFIR Investigator

Note: The job is a remote job and is open to candidates in USA. SentinelOne is redefining cybersecurity with AI-powered innovations. They are seeking a Staff DFIR Investigator to conduct digital forensic investigations and threat hunting operations for global clients, ensuring excellence in engagements and contributing to community-facing publications. Responsibilities • Accountable to ensure excellence in every engagement, to include scoping, forensic analysis, reporting, hunting, remediation consulting, and client communication. • Analyze malware, exploits and other suspicious files from DFIR cases to add context and threat intelligence, including performing deep reverse engineering analysis to understand malware functionality and attack vectors. • Perform oversight on identified IOCs and enrich context when necessary through comprehensive malware reverse engineering. • Augment both the forensics processing pipeline and malware analysis infrastructure with new tools and scenarios to streamline reverse engineering workflows. • Spearhead efforts to publish blogs on unique threats, relevant DFIR cases, and new forensic discoveries during incidents, with emphasis on malware reverse engineering findings. • Contribute as a lead investigator for engagements. Manage all aspects of a breach response and containment investigation. • Technical investigative skills must include host-based forensic analysis, EDR-driven incident response, malware analysis, memory analytics, and network log investigations. • Provide detailed and impactful formal investigative reports, to include technical findings and security improvement recommendations. • Work closely with the threat intelligence team to pursue attribution, identify attack trends, innovative malicious TTPs, and contribute to community-facing publications and blogs. Skills • 4+ years of hands-on consulting experience in threat hunting, digital forensics, and incident response. • Malware reverse engineering skills using tools such as IDA Pro, Ghidra, x64dbg, or similar disassemblers and debuggers. • Proficiency in static and dynamic malware analysis techniques, including unpacking, deobfuscation, and behavioral analysis. • Experience with scripting languages (Python, PowerShell) for automation of reverse engineering tasks and malware analysis workflows. • Advanced experience conducting dynamic malware analysis in sandboxed environments and deep understanding of the complete reverse engineering process. • Knowledge of various malware families, attack frameworks, and ability to identify new or modified variants through reverse engineering analysis. • Understanding of Windows/Linux internals, assembly language, and common evasion techniques employed by modern malware. • Experience with forensic investigative software. • Experience with EDR/XDR platforms (SentinelOne preferred). • Experience with memory analytics (Volatility Preferred). • Experience or knowledge of conducting endpoint based threat hunting (compromise assessments). • Experience working with cyber threat intelligence platforms and the threat intelligence process from raw attack data to finished intel and publications. Benefits • Medical, Vision, Dental, 401(k), Commuter, Health and Dependent FSA • Unlimited PTO • Industry leading gender-neutral parental leave • Paid Company Holidays • Paid Sick Time • Employee stock purchase program • Disability and life insurance • Employee assistance program • Gym membership reimbursement • Cell phone reimbursement • Numerous company-sponsored events including regular happy hours and team building events Company Overview • SentinelOne is an autonomous cybersecurity solution company. It was founded in 2013, and is headquartered in Mountain View, California, USA, with a workforce of 1001-5000 employees. Its website is Company H1B Sponsorship • SentinelOne has a track record of offering H1B sponsorships, with 10 in 2025, 14 in 2024, 2 in 2023, 18 in 2022, 5 in 2021. Please note that this does not guarantee sponsorship for this specific role. Apply tot his job Apply tot his job