Principal Software Engineer, AI SIEM

🕒 July 28

🇺🇸 United States – Remote

💵 $216k - $297k / year

⏰ Full Time

🔴 Lead

🤖 AI Engineer

🦅 H1B Visa Sponsor

This company has sponsored H1B visas in the past.

👻 Ghost score 15%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

SentinelOne

WebsiteLinkedInAll Job Openings

1001 - 5000 employees

Founded 2013

💼 Consulting

🏥 Healthcare

📦 Logistics

Consulting • Healthcare • Logistics

SentinelOne is a leader in autonomous cybersecurity, known for its innovative use of AI across endpoint, cloud, and identity protection solutions. It is recognized by Gartner as a leader in the Magic Quadrant for Endpoint Protection Platforms for four consecutive years. SentinelOne's Singularity platform integrates enterprise security, offering features like AI-powered threat detection, endpoint and cloud security, vulnerability management, and threat intelligence. The company supports various industries by delivering real-time protection and operational efficiency while leveraging AI for advanced threat hunting and log analytics. With a strong focus on reducing risk and enhancing security performance, SentinelOne caters to enterprises worldwide with secure, scalable solutions.

📋 Description

• Build a working mental model of the full system, including ingest and storage, query and retrieval, analyst-facing workflows (alerts, findings, assets, incidents), and the detection engines (rule-based and beyond), and use it to identify where architecture is solid, where it's fragile, and where teams are unknowingly duplicating effort or leaving gaps between their boundaries. • Drive cross-team architectural decisions that affect multiple parts of the system at once, for example, how ingest-time enrichment should relate to detection logic, or how detection output should shape what an analyst sees and can act on. • Partner with the engineering leads of each pillar (data platform, analyst experience, detection engines) as a peer thought partner, not a top-down authority, influencing through technical credibility and clear reasoning, not mandate. • Identify and prioritize the highest-leverage architectural investments across the system, and make the case for them to engineering leadership and product. • Get hands-on where it matters: prototype, review, and occasionally build the connective tissue between pillars when no single team naturally owns it. • Establish and champion cross-cutting technical standards, for APIs, data contracts, and service boundaries, that keep independently-developed pillars interoperable as they evolve. • Mentor senior and staff engineers across teams, raising the bar for architectural thinking org-wide, not just within one team. • Represent the technical health of the overall system in planning and leadership conversations, translating "what's exceptional, what's a gap, what's redundant" into a roadmap.

🎯 Requirements

• Deep experience (15 or more years) building and operating large-scale distributed backend systems, with direct experience in at least two of: high-throughput data ingest/storage, query engines, or detection/rules systems. • A demonstrated track record of reasoning about systems at the architecture level, not just implementing a spec, but identifying where a system's boundaries are wrong, where responsibilities overlap, and where they leave gaps. • Experience designing APIs and service contracts that need to hold up across teams and years, not just within one codebase. • Comfort operating without a single clear chain of command, influencing peer teams and senior engineers through the strength of your reasoning. • A four-year degree in Computer Science or equivalent practical experience. • Familiarity with security operations concepts (alerts, findings, assets, incidents, detection rules) is preferred; if you don't have direct SIEM/XDR background, you should be someone who can get fluent in a new domain fast. • Experience with modern cloud infrastructure and data-intensive systems (distributed storage, high-cardinality querying, streaming pipelines) is preferred; specific tools matter less than demonstrated judgment about tradeoffs at scale. • Exposure to both rule-based and ML/AI-driven detection approaches is a plus, but the more important trait is being able to reason about when each is the right tool.

🏖️ Benefits

• Restricted Stock Units (RSUs) • Employee Stock Purchase Plan (ESPP) • Flexible time off • Paid company holidays and paid sick time • Gender-neutral parental leave • Grandparent leave • Medical, dental, and vision coverage • 401(k) retirement plan with company match • Life and disability insurance • Health and dependent care FSA • Voluntary benefits (hospital, accident, critical illness) • Employee Assistance Program (EAP) • ARAG pre-paid legal • Nationwide pet insurance • Cancer Care program • Global business travel medical insurance • Home office allowance • Mobile phone reimbursement • Wellness coach • Wellness/gym reimbursement • Fertility coverage • Adoption & surrogacy reimbursement