SentinelOne Engineer (R-00249)

True Zero Technologies is a veteran-owned small business founded on the principle that the purposeful enablement of people and technology directly drives the quality of an organization’s outcomes. We design and deliver cybersecurity programs and software solutions that empower federal, state and local government, education, and commercial leaders to run a proactive defense with better intelligence and more efficient collaboration. Recent recognitions include Inc. Magazine’s 2026 Best Workplaces list and awarded positions on Fairfax County VA Cybersecurity Program, Montana ITS Contract, Kansas Services MSA, DARPA’s MANNUS IDIQ, NASA SEWP VI, and the $151B SHIELD contract.

Our endpoint and detection engineering practice helps organizations get full value out of the SentinelOne platform — governance first, integrated with Zero Trust architecture, and aligned to the NIST Risk Management Framework and NIST SP 800-53. We build secure, highly tuned detection and response capabilities that keep critical systems protected without overwhelming security teams with noise.

Position Overview

True Zero is seeking a Certified SentinelOne Engineer to lead the ongoing operations, tuning, and optimization of SentinelOne across secure, mission-critical environments — including use of the platform as a SIEM for centralized log management, detection, and correlation. This is a senior technical role for an engineer who pairs deep, hands-on SentinelOne expertise with the judgment to guide teams, engage clients, and deliver production-grade, highly reliable endpoint and SIEM operations.

The ideal candidate holds current SentinelOne Certified Engineer status and brings a track record of running and continuously optimizing SentinelOne in production — tuning detection policies, managing the agent fleet, and operating SentinelOne’s SIEM capabilities for log ingestion, correlation, and alerting. Experience supporting state government customers is a strong plus, given True Zero’s growing work across SLED environments.

Key Responsibilities

Platform Operations: Own the day-to-day administration of SentinelOne across managed environments, including agent deployment, policy management, and fleet health.
SIEM Operations & Optimization: Operate and continuously optimize SentinelOne’s SIEM capabilities — log ingestion, correlation rules, dashboards, and alerting — to maximize detection coverage and minimize false positives.
Detection Engineering & Tuning: Design, tune, and validate detection policies and Deep Visibility/Storyline queries to keep pace with evolving threats while reducing analyst noise.
Incident Response Support: Support triage, investigation, and remediation of SentinelOne-detected threats, including threat hunting and root-cause analysis.
Systems Integration: Integrate SentinelOne with SIEM, SOAR, ticketing, and other security tooling to ensure seamless data flow and unified workflows.
Performance & Health Monitoring: Monitor agent health, policy coverage, and platform performance; identify and remediate gaps across the managed fleet.
Upgrades & Lifecycle Management: Manage SentinelOne upgrades, policy version control, and lifecycle changes with minimal operational disruption.
Governance & Compliance: Ensure SentinelOne operations align with regulatory and security requirements, including NIST SP 800-53 and Zero Trust principles, and state-specific requirements where applicable.
Reporting: Deliver technical reports on endpoint and SIEM health, detection posture, and tuning outcomes with clear, actionable recommendations.
Client Collaboration: Engage with clients and stakeholders throughout the engagement lifecycle, including state government customers where assigned.
Team Development: Coach and mentor junior engineers on SentinelOne operations and detection engineering best practices.

Qualification & Requirements

Certification: Must be a SentinelOne Certified Engineer (current certification required).
Experience: Minimum of 3–5 years in endpoint security, detection engineering, or SOC operations, with substantial hands-on SentinelOne administration.
SIEM Operations: Required: experience with the ongoing operations and optimization of SentinelOne as a SIEM platform, including log management, correlation, and alert tuning.
Technical Proficiency: Hands-on experience with EDR/XDR administration, policy tuning, Deep Visibility/Storyline queries, and threat hunting workflows.
Systems Integration: Experience integrating EDR/SIEM platforms with SOAR, ticketing, and broader security tooling.
Governance: Familiarity with NIST SP 800-53, Zero Trust architecture principles, and general security compliance frameworks.
Communication: Excellent written and verbal skills to convey technical information to diverse audiences.
Education: Bachelor’s degree in Computer Science, Cybersecurity, Information Technology, or a related field preferred; equivalent experience considered.
Preferred Experience
Experience supporting state government (SLED) customers is a plus.
Additional security certifications (e.g., Security+, CySA+, GCIH, or equivalent) are a plus.
Experience with other EDR/SIEM platforms (e.g., Splunk, CrowdStrike) is a plus.
Prior experience at a Veteran-Owned Small Business or similar government-focused contractor is a plus.