Offensive Security Researcher

About Us

SentinelOne is a company at the intersection of AI and security, pioneering a new operating model for cybersecurity. Our AI-native platform unifies protection across endpoint, cloud, identity, data, and AI systems to deliver autonomous detection and response with clarity and speed. By combining real-time analytics, intelligent automation, and a unified data foundation, we reduce noise, simplify complexity, and empower security teams to focus on what truly matters.

Our teams are builders, problem-solvers, and innovators committed to shaping the future of security. If you are excited to solve hard problems alongside talented, mission-driven people, we invite you to help us build a safer future for humanity.

What Are We Looking For?

We’re looking for people who are relentlessly curious and committed to continuous learning. AI is reshaping every function across our business, and we enable every team member, regardless of role or level, to build fluency in AI tools and concepts. Those who thrive here actively seek out new solutions, experiment thoughtfully, and apply what they learn to drive better, faster, smarter outcomes.

As an Offensive Security Researcher, you will be tasked with studying how attackers break into cloud, identity, and AI environments, and turning that knowledge into detection content that ships in the SentinelOne platform. Your research will power the Offensive Security Engine, which verifies whether exposed assets are actually exploitable, along with our cloud, identity, and AI security detections. This is a research role: you will spend your time understanding attacks deeply, reproducing them in a lab, and writing the detections that catch them.

What Will You Do?

Primary responsibilities include:

* Offensive Security Engine: research vulnerabilities and misconfigurations in internet-exposed services, reproduce them in a lab, and write exploit templates that safely confirm whether they are exploitable, with very few false positives.
* Cloud: research attack paths in AWS, Azure, and GCP, such as IAM privilege escalation, misconfigured services, cross-account or cross-tenant access, and Kubernetes and container attacks (RBAC abuse, container escape, exposed kubelets and dashboards, and cloud IAM-to-cluster paths across EKS, AKS, and GKE), and turn them into detections.
* Identity: research attacks against Entra ID and Active Directory, including hybrid paths between on-prem and cloud.
* AI Security: research attacks on AI applications, agents, and AI infrastructure, such as prompt injection, tool and MCP abuse, and exposed inference or MLOps services.
* AI-Assisted Research: use AI and agentic systems to speed up research, from analyzing CVEs and threat reports to drafting and testing detections.
* Documentation and Industry Presence: write clear research notes and, where appropriate, public blogs, threat advisories, and conference talks.

What Skills and Knowledge Will You Bring?

Ideal candidates will have:

* 2 to 4 years of hands-on experience in offensive security, security research, or detection engineering.
* Hands-on depth in at least two of the following areas, and a willingness to learn the rest: exposure and exploitation (taking a known CVE or misconfiguration and building a reliable, safe PoC or verification check); cloud (IAM abuse and privilege escalation in AWS, Azure, or GCP, and/or Kubernetes and container security); identity (Active Directory attacks such as Kerberos abuse, ADCS, ACL abuse, and NTLM relay, and Entra ID attacks such as token abuse, consent and app-registration abuse, and hybrid sync paths); and AI security (OWASP Top 10 for LLM Applications, and how agents using tool calling and MCP can be abused).
* Detection engineering skills: the ability to turn an attack into detection logic, knowing which logs show it (for example CloudTrail, Azure Activity and Entra sign-in and audit logs, GCP Audit Logs, Kubernetes audit logs, and domain controller events) and writing a rule that catches it without excessive noise.
* Strong Python scripting skills for PoCs, lab automation, and data analysis.
* Responsible research habits, including safe lab practice and coordinated disclosure.
* Public work such as CVEs, blog posts, detection rules, CTF results, bug bounty findings, or talks is preferred.
* Experience with a query language such as KQL, SPL, or SQL is preferred.
* Experience building or using AI and LLM-assisted workflows for security research or detection engineering is preferred.
* Familiarity with Shodan, Censys, ExploitDB, BloodHound, Pacu, and Stratus Red Team for exposure research is preferred.
* Certifications such as OSCP, CRTP, or similar cloud and AI certifications are preferred, though they are one signal among several and not a requirement.

Why SentinelOne?

AI is redefining how the world operates and rewriting the rules of security in real time, and SentinelOne was built for this moment. From day one, we architected an AI-native platform designed to operate at machine speed, not as an add-on to legacy systems but as the foundation itself. If you want to build where innovation and impact move together, this is that place.

We invest in our Sentinels with comprehensive, competitive benefits designed to support you and your family:

Equity & Rewards

* Restricted Stock Units (RSUs)
* Employee Stock Purchase Plan (ESPP)

Time Off & Wellbeing

* Competitive leave benefits
* Gender-neutral parental leave

Insurance & Financial Security

* Medical and insurance benefits
* Employee Assistance Program (EAP)

Work Perks & Flexibility

* Global home office allowance
* Internet allowance
* LinkedIn Learning license
* Social Connect program
* Food allowance (Bangalore office)
* Meal vouchers (Sodexo)

Wellness & Lifestyle

* Health & wellness benefit

SentinelOne is proud to be an Equal Employment Opportunity and Affirmative Action employer. We do not discriminate based upon race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics.

SentinelOne participates in the E-Verify Program for all U.S. based roles.

To learn more about how we use AI in our hiring process, please review our AI in Hiring Candidate Disclosure.