DFIR – Engagement Manager at SentinelOne · Trevo

Job description

About the role

Our Purpose At SentinelOne, we are driven by a clear purpose: to give the advantage to those who secure our future. As AI reshapes how organizations build, operate, and innovate, the responsibility to protect them becomes more critical than ever. When you join SentinelOne, your work helps protect global enterprises, critical infrastructure, and the technologies shaping tomorrow. If you are motivated by meaningful challenges and want your impact to be real, measurable, and global, you will find purpose here. SentinelOne is a company at the intersection of AI and security, pioneering a new operating model for cybersecurity. Our AI-native platform unifies protection across endpoint, cloud, identity, data, and AI systems to deliver autonomous detection and response with clarity and speed. By combining real-time analytics, intelligent automation, and a unified data foundation, we reduce noise, simplify complexity, and empower security teams to focus on what truly matters. Our teams are builders, problem-solvers, and innovators committed to shaping the future of security. If you are excited to solve hard problems alongside talented, mission-driven people, we invite you to help us build a safer future for humanity. What Are We Looking For? We’re looking for people who are relentlessly curious and committed to continuous learning. AI is reshaping every function across our business, and we enable every team member, regardless of role or level, to build fluency in AI tools and concepts. Those who thrive here actively seek out new solutions, experiment thoughtfully, and apply what they learn to drive better, faster, smarter outcomes. ***USA (Pacific, Mountain, Alaska, or Hawaii time zones)*** SentinelOne’s Digital Forensics and Incident Response (DFIR) team delivers rapid, expert breach response to global enterprises facing active cyber threats — including ransomware, business email compromise, identity compromise, zero-day exploitation, APT activity, and cloud/SaaS breaches. As an Engagement Manager (EM), you'll own the full lifecycle of DFIR investigations — from scoping and staffing through budget management and delivery. You will serve as the primary point of contact between our DFIR analysts and all stakeholders, including account teams, customer executives, breach counsel, and cyber insurance carriers. You'll move comfortably between technical detail and executive-level conversations during high-stakes incidents. Your exceptional communication and project management skills drive the engagement lifecycle, backed by practitioner-level DFIR knowledge. You will provide valuable technical expertise by partnering with investigation technical leads to align on analytical focus and findings, and providing hands-on surge support for data collection and forensic analysis as needed. This role also requires U.S. citizenship and FedRAMP eligibility to support occasional investigations for our FedRAMP customers. What Will You Do?

What you'll do

Oversee active DFIR investigations end-to-end, ensuring exceptional quality, timely deliverables, and appropriate resource allocation.
Staff analysts onto engagements based on scope, skillset, and availability, and monitor team capacity to keep workload balanced.
Lead scoping and business development activities — incident intake, requirements gathering, and SOW/tri-party development.
Manage each engagement's retainer hour budget, tracking usage against scope and coordinating uplift or overage conversations with customers and account teams.
Establish and own clear communication channels across all investigation stakeholders, including internal teams, customers, external breach counsel, and cyber insurance carriers.
Own escalations end-to-end, resolving technical or operational challenges.
Oversee case documentation, evidence handling, and chain of custody, and manage retention and deletion timelines at engagement closure, including customer requests for early deletion.
Work with each case’s technical lead to shape investigative direction and validate findings, and ensure workstreams meet customer expectations and reporting standards.
Ensure strict adherence to standard operating procedures and incident response best practices.
Manage the delivery of timely, accurate status updates and recommendations to customers and stakeholders throughout the engagement.
Act as hands-on surge support and conduct technical analysis as needed to maintain investigative momentum when team capacity requires it.
Lead post-engagement reviews and drive process improvement initiatives to optimize team workflows.
Participate in a rotating on-call schedule for weekends and holidays, to support active incident response.
What Skills and Knowledge Will You Bring?
Ideal candidates will have:
5+ years of hands-on consulting experience in digital forensics and incident response, including engagement or project management experience in a cybersecurity consulting or IR services delivery role.
Bachelor's or Master's degree in Digital Forensics, Cybersecurity, Computer Science, or a related technical field (or equivalent practical self-study).
Industry certifications (GCFE, GCFA, GREM, CFCE, EnCE, or similar).
Proven track record of managing complex, multi-stakeholder incident response engagements.
Excellence in client communication and relationship management, with comfort working with executive stakeholders, legal counsel, and insurance carriers.
Ability to translate complex technical findings into business impact for non-technical stakeholders.
Expert-level experience with industry-standard forensic tools and methodologies.
Strong understanding of and experience with EDR/XDR platforms and security technologies.
Strong staffing, resource-coordination, and team leadership skills.
An evident self-starter with intellectual curiosity and the ability to adapt to change.
Requires U.S. citizenship and FedRAMP eligibility.

Nice to have

Experience conducting malware analysis and memory forensics.
Demonstrated experience in endpoint-based threat-hunting and compromise assessments.
Experience working with cyber threat intelligence platforms and processes.
Active participation in the security community through speaking engagements or publications.
Why SentinelOne?
AI is redefining how the world operates and rewriting the rules of security in real time, and SentinelOne was built for this moment. From day one, we architected an AI-native platform designed to operate at machine speed, not as an add-on to legacy systems but as the foundation itself. If you want to build where innovation and impact move together, this is that place.
We invest in our Sentinels with comprehensive, competitive benefits designed to support you and your family:
Equity & Rewards
Restricted Stock Units (RSUs)
Employee Stock Purchase Plan (ESPP)
Time Off & Wellbeing
Flexible time off
Paid company holidays and paid sick time
Gender-neutral parental leave
Grandparent leave
Insurance & Financial Security
Medical, dental, and vision coverage
401(k) retirement plan with company match
Life and disability insurance
Health and dependent care FSA
Voluntary benefits (hospital, accident, critical illness)
Employee Assistance Program (EAP)
ARAG pre-paid legal
Nationwide pet insurance
Cancer Care program
Global business travel medical insurance
Work Perks & Flexibility
Home office allowance
Mobile phone reimbursement
Wellness & Lifestyle
Wellness coach
Wellness/gym reimbursement
Fertility coverage
Adoption & surrogacy reimbursement
This U.S. role has a base pay range that will vary based on the location of the candidate. For some locations, a different pay range may apply. If so, this range will be provided to you during the recruiting process. You can also reach out to the recruiter with any questions.
Base Salary Range
$132,000—$160,000 USD
SentinelOne is proud to be an Equal Employment Opportunity and Affirmative Action employer. We do not discriminate based upon race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics.
SentinelOne participates in the E-Verify Program for all U.S. based roles.

More roles at this company

About the role

What you'll do

Nice to have