About this role
Position Overview
True Zero is seeking a Certified SentinelOne Engineer to lead the ongoing operations, tuning, and optimization of SentinelOne across secure, mission-critical environments — including use of the platform as a SIEM for centralized log management, detection, and correlation. This is a senior technical role for an engineer who pairs deep, hands-on SentinelOne expertise with the judgment to guide teams, engage clients, and deliver production-grade, highly reliable endpoint and SIEM operations.
The ideal candidate holds current SentinelOne Certified Engineer status and brings a track record of running and continuously optimizing SentinelOne in production — tuning detection policies, managing the agent fleet, and operating SentinelOne’s SIEM capabilities for log ingestion, correlation, and alerting. Experience supporting state government customers is a strong plus, given True Zero’s growing work across SLED environments.
Key Responsibilities
- Platform Operations: Own the day-to-day administration of SentinelOne across managed environments, including agent deployment, policy management, and fleet health.
- SIEM Operations & Optimization: Operate and continuously optimize SentinelOne’s SIEM capabilities — log ingestion, correlation rules, dashboards, and alerting — to maximize detection coverage and minimize false positives.
- Detection Engineering & Tuning: Design, tune, and validate detection policies and Deep Visibility/Storyline queries to keep pace with evolving threats while reducing analyst noise.
- Incident Response Support: Support triage, investigation, and remediation of SentinelOne-detected threats, including threat hunting and root-cause analysis.
- Systems Integration: Integrate SentinelOne with SIEM, SOAR, ticketing, and other security tooling to ensure seamless data flow and unified workflows.
- Performance & Health Monitoring: Monitor agent health, policy coverage, and platform performance; identify and remediate gaps across the managed fleet.
- Upgrades & Lifecycle Management: Manage SentinelOne upgrades, policy version control, and lifecycle changes with minimal operational disruption.
- Governance & Compliance: Ensure SentinelOne operations align with regulatory and security requirements, including NIST SP 800-53 and Zero Trust principles, and state-specific requirements where applicable.
- Reporting: Deliver technical reports on endpoint and SIEM health, detection posture, and tuning outcomes with clear, actionable recommendations.
- Client Collaboration: Engage with clients and stakeholders throughout the engagement lifecycle, including state government customers where assigned.
- Team Development: Coach and mentor junior engineers on SentinelOne operations and detection engineering best practices.
Qualification & Requirements
- Certification: Must be a SentinelOne Certified Engineer (current certification required).
- Experience: Minimum of 3–5 years in endpoint security, detection engineering, or SOC operations, with substantial hands-on SentinelOne administration.
- SIEM Operations: Required: experience with the ongoing operations and optimization of SentinelOne as a SIEM platform, including log management, correlation, and alert tuning.
- Technical Proficiency: Hands-on experience with EDR/XDR administration, policy tuning, Deep Visibility/Storyline queries, and threat hunting workflows.
- Systems Integration: Experience integrating EDR/SIEM platforms with SOAR, ticketing, and broader security tooling.
- Governance: Familiarity with NIST SP 800-53, Zero Trust architecture principles, and general security compliance frameworks.
- Communication: Excellent written and verbal skills to convey technical information to diverse audiences.
- Education: Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related field preferred; equivalent experience considered.
Preferred Experience
- Experience supporting state government (SLED) customers is a plus.
- Additional security certifications (e.g., Security+, CySA+, GCIH, or equivalent) are a plus.
- Experience with other EDR/SIEM platforms (e.g., Splunk, CrowdStrike) is a plus.
- Prior experience at a Veteran-Owned Small Business or similar government-focused contractor is a plus.