Staff Threat Researcher

Join to apply for the Staff Threat Researcher role at SentinelOne

2 days ago Be among the first 25 applicants

Join to apply for the Staff Threat Researcher role at SentinelOne

About Us

At SentinelOne, we’re redefining cybersecurity by pushing the limits of what’s possible—leveraging AI-powered, data-driven innovation to stay ahead of tomorrow’s threats.

About Us

At SentinelOne, we’re redefining cybersecurity by pushing the limits of what’s possible—leveraging AI-powered, data-driven innovation to stay ahead of tomorrow’s threats.

From building industry-leading products to cultivating an exceptional company culture, our core values guide everything we do. We’re looking for passionate individuals who thrive in collaborative environments and are eager to drive impact. If you’re excited about solving complex challenges in bold, innovative ways, we’d love to connect with you.

What are we looking for?

We are seeking a highly motivated and skilled individual to join our team as a Staff Threat (Intelligence) Researcher. The ideal new colleague should have a solid background in cybercrime investigation / threat research - incl. especially Linux and / or Cloud, and malware analysis. You will be responsible for conducting in-depth research and analysis of emerging and existing threats, provide actionable intelligence for detection, and will leverage your deep understanding of the tactics, techniques, and procedures used by ransomware operators and their ecosystem.

What You’ll Do?

• Lead threat intelligence initiatives to proactively research, analyze, and assess emerging cyber threats, including ransomware groups, financially motivated actors with a focus on developing detection strategies.
• Perform in-depth technical threat analysis, including malware reverse engineering (static / dynamic), campaign tracking, and infrastructure profiling, to inform and drive detection logic in endpoint detection and response (EDR) platforms.
• Develop high-fidelity detection logic (YARA, platform rules etc) based on actionable intelligence derived from malware capabilities, actor TTPs, and behavioral patterns observed in telemetry and forensic artifacts.
• Design and implement threat hunting strategies to proactively discover malicious activity, unearth novel attack patterns, and surface IOCs and BOIs across diverse environments.
• Continuously curate and maintain a threat intelligence knowledge base, including actor profiles, toolsets, infrastructure usage, TTPs, and affiliations, with a special focus on tracking ransomware and their evolving ecosystems.
• Monitor adversary infrastructure (C2s, exploit servers), and develop automated methods to fingerprint and track infrastructure reuse across campaigns.
• Collaborate with detection engineers to align threat research with detection coverage gaps
• Produce actionable intelligence reports and detection recommendations for internal stakeholders, including concise executive briefings and deep technical analysis for detection engineering and response teams.
• Stay ahead of the curve on malware trends, evasive techniques, and novel TTPs, and map findings to threat models (e.g., MITRE ATT&CK, Diamond Model) to maintain contextual awareness and detection depth.
• Mentor and guide detection engineers, promoting a culture of continuous learning, collaboration, and threat-informed defense.

What experience or knowledge should you bring?

Nice-to-Have Skills and Qualifications :

Why Us?

Because you will meet extraordinary challenges facing the newest attacks and tech obstacles and overcoming them. You will work with the very BEST in the industry in a flexible and independent environment. You will influence the design of a disruptive product that will shape the security industry of tomorrow.

What We Offer You

Aditional Country-specific Benefits To Spain

SentinelOne is proud to be an Equal Employment Opportunity and Affirmative Action employer. We do not discriminate based upon race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics.

SentinelOne participates in the E-Verify Program for all U.S. based roles. Seniority level

Employment type

Job function

Referrals increase your chances of interviewing at SentinelOne by 2x

Sign in to set job alerts for “Cyber Threat Investigator” roles. Security Architect and Cyber-Threat Intelligence Analyst

Madrid, Community of Madrid, Spain 2 days ago

Senior Presales Engineer - Cloud Security Start Up Vendor - Paying €200,000 OTE + Stock

Madrid, Community of Madrid, Spain 2 months ago

Senior Cloud Security Engineer (100% remote, only Spain)

Sevilla La Nueva, Community of Madrid, Spain 3 months ago

Madrid, Community of Madrid, Spain 3 months ago

Salamanca, Castilla and Leon, Spain 3 months ago

Senior Malware Researcher / Detection Engineer - Linux / Cloud Security Senior Director Analyst, Security Architecture and Cloud Security (Remote Canada and EMEA)

Madrid, Community of Madrid, Spain 2 weeks ago

Security Analyst Experience - Senior Software Engineer, Generative AI

We’re unlocking community knowledge in a new way. Experts add insights directly into each article, started with the help of AI.

J-18808-Ljbffr