Were looking for people who are relentlessly curious and committed to continuous learning. AI is reshaping every function across our business, and we enable every team member, regardless of role or level, to build fluency in AI tools and concepts. Those who thrive here actively seek out new solutions, experiment thoughtfully, and apply what they learn to drive better, faster, smarter outcomes.

USA (Pacific, Mountain, Alaska, or Hawaii time zones)

SentinelOnes Digital Forensics and Incident Response (DFIR) team delivers rapid, expert breach response to global enterprises facing active cyber threats including ransomware, business email compromise, identity compromise, zero-day exploitation, APT activity, and cloud/SaaS breaches. As an Engagement Manager (EM), you'll own the full lifecycle of DFIR investigations from scoping and staffing through budget management and delivery. You will serve as the primary point of contact between our DFIR analysts and all stakeholders, including account teams, customer executives, breach counsel, and cyber insurance carriers. You'll move comfortably between technical detail and executive-level conversations during high-stakes incidents.

Your exceptional communication and project management skills drive the engagement lifecycle, backed by practitioner-level DFIR knowledge. You will provide valuable technical expertise by partnering with investigation technical leads to align on analytical focus and findings, and providing hands-on surge support for data collection and forensic analysis as needed. This role also requires U.S. citizenship and FedRAMP eligibility to support occasional investigations for our FedRAMP customers.

What Will You Do

Primary responsibilities include:
Oversee active DFIR investigations end-to-end, ensuring exceptional quality, timely deliverables, and appropriate resource allocation.
Staff analysts onto engagements based on scope, skillset, and availability, and monitor team capacity to keep workload balanced.
Lead scoping and business development activities incident intake, requirements gathering, and SOW/tri-party development.
Manage each engagement's retainer hour budget, tracking usage against scope and coordinating uplift or overage conversations with customers and account teams.
Establish and own clear communication channels across all investigation stakeholders, including internal teams, customers, external breach counsel, and cyber insurance carriers.
Own escalations end-to-end, resolving technical or operational challenges.
Oversee case documentation, evidence handling, and chain of custody, and manage retention and deletion timelines at engagement closure, including customer requests for early deletion.
Work with each cases technical lead to shape investigative direction and validate findings, and ensure workstreams meet customer expectations and reporting standards.
Ensure strict adherence to standard operating procedures and incident response best practices.
Manage the delivery of timely, accurate status updates and recommendations to customers and stakeholders throughout the engagement.
Act as hands-on surge support and conduct technical analysis as needed to maintain investigative momentum when team capacity requires it.
Lead post-engagement reviews and drive process improvement initiatives to optimize team workflows.
Participate in a rotating on-call schedule for weekends and holidays, to support active incident response.

What Skills and Knowledge Will You Bring

Ideal candidates will have:
5+ years of hands-on consulting experience in digital forensics and incident response, including engagement or project management experience in a cybersecurity consulting or IR services delivery role.
Bachelor's or Master's degree in Digital Forensics, Cybersecurity, Computer Science, or a related technical field (or equivalent practical self-study).
Industry certifications (GCFE, GCFA, GREM, CFCE, EnCE, or similar).
Proven track record of managing complex, multi-stakeholder incident response engagements.
Excellence in client communication and relationship management, with comfort working with executive stakeholders, legal counsel, and insurance carriers.
Ability to translate complex technical findings into business impact for non-technical stakeholders.
Expert-level experience with industry-standard forensic tools and methodologies.
Strong understanding of and experience with EDR/XDR platforms and security technologies.
Strong staffing, resource-coordination, and team leadership skills.
An evident self-starter with intellectual curiosity and the ability to adapt to change.
Requires U.S. citizenship and FedRAMP eligibility.

Nice to Have:
Experience conducting malware analysis and memory forensics.
Demonstrated experience in endpoint-based threat-hunting and compromise assessments.
Experience working with cyber threat intelligence platforms and processes.
Active participation in the security community through speaking engagements or publications.

Why SentinelOne

AI is redefining how the world operates and rewriting the rules of security in real time, and SentinelOne was built for this moment. From day one, we architected an AI-native platform designed to operate at machine speed, not as an add-on to legacy systems but as the foundation itself. If you want to build where innovation and impact move together, this is that place.

We invest in our Sentinels with comprehensive, competitive benefits designed to support you and your family:

Equity and Rewards
Restricted Stock Units (RSUs)
Employee Stock Purchase Plan (ESPP)

Time Off and Wellbeing
Flexible time off
Paid company holidays and paid sick time
Gender-neutral parental leave
Grandparent leave

Insurance and Financial Security
Medical, dental, and vision coverage
401(k) retirement plan with company match
Life and disability insurance
Health and dependent care FSA
Voluntary benefits (hospital, accident, critical illness)
Employee Assistance Program (EAP)
ARAG pre-paid legal
Nationwide pet insurance
Cancer Care program
Global business travel medical insurance

Work Perks and Flexibility
Home office allowance
Mobile phone reimbursement

Wellness and Lifestyle
Wellness coach
Wellness/gym reimbursement
Fertility coverage
Adoption and surrogacy reimbursement

::: {style="color: #5a5c76; background-color: #ffffff; margin: 0px; font-size: 18px; font-family: SentinelSans, ui-sans-serif, system-ui, sans-serif; borde
"}
:::

SentinelOne, Inc

New Jobs

DFIR Engagement Manager