About Us:
SentinelOne is defining the future of cybersecurity through our XDR platform that automatically prevents, detects, and responds to threats in real-time. Singularity XDR ingests data and leverages our patented AI models to deliver autonomous protection. With SentinelOne, organizations gain full transparency into everything happening across the network at machine speed – to defeat every attack, at every stage of the threat lifecycle.
We are a values-driven team where names are known, results are rewarded, and friendships are formed. Trust, accountability, relentlessness, ingenuity, and OneSentinel define the pillars of our collaborative and unified global culture. We're looking for people that will drive team success and collaboration across SentinelOne. If you’re enthusiastic about innovative approaches to problem-solving, we would love to speak with you about joining our team!
What are we looking for?
We are seeking a highly motivated and skilled individual to join our team as a Senior Threat Intelligence Researcher for Linux research. The ideal candidate should have a solid background in cybercrime investigation, and malware analysis. The candidate will be responsible for conducting in-depth research and analysis of emerging and existing threats, provide actionable intelligence for detection, and possess a deep understanding of the tactics, techniques, and procedures used by ransomware operators and their ecosystem.
What will you do?
- Lead and conduct in-depth research and analysis of emerging and existing cyber threats, including ransomware campaigns, and other sophisticated attacks.
- Utilize reverse engineering and malware analysis skills to identify and analyze malicious code and artifacts.
- Create actionable intelligence reports and threat briefings to inform senior management and key stakeholders of the potential risks associated with ransomware groups.
- keep curating a KB on ransomware operations, their tradecraft, affiliations.
- Identify and track threat actors, their capabilities, and the infrastructure they use.
- Analyze malware samples and artifacts to identify their functionality, capabilities, and potential impact.
- Stay current with emerging malware trends, attack techniques, and evasion tactics.
- creating and maintaining hunting strategies to keep track of operations and shifting in tactics
- creating and maintaining hunting strategies to keep track of operations and shifting in tactics- Monitoring malicious infrastructures and extract fingerprints to track C2s
What experience or knowledge should you bring?
- Strong knowledge of malware analysis tools and techniques, including static and dynamic analysis, sandboxing, and debugging. + Knowledge of unpacking and deobfuscation.
- Understanding software vulnerabilities, and ability to implement hunting strategies to track and discover them
- Knowledge of various threat intelligence frameworks such as the Diamond Model, MITRE ATT&CK.
- Knowledge of the cyber threat landscape, including actors and TTPs
- Strong analytical skills, with the ability to identify patterns and trends in large datasets
- strong knowledge of Yara to track new malware families and knowledge on validation best practices
- knowledge of Linux Internals, Linux Threats , Extended Berkeley Packet Filter (eBPF) and Linux container
- rudimentary knowledge about working of EDR in Linux environment
- familiarity with linux shell scripting (example, bash, zsh, lua)
- Relevant certifications, such as Certified Malware Analyst (CMA), Certified Reverse Engineering Analyst (CREA), or GIAC Certified Malware Reverse Engineer (GREM) good to have.
- programming experience with python, perl or lua
- familiarity with Linux distributions and their differences
SentinelOne is proud to be an Equal Employment Opportunity and Affirmative Action employer. We do not discriminate based upon race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics.
SentinelOne participates in the E-Verify Program for all U.S. based roles.