Principal Software Engineer, AI SIEM

Our Purpose

At SentinelOne, we are driven by a clear purpose: to give the advantage to those who secure our future. As AI reshapes how organizations build, operate, and innovate, the responsibility to protect them becomes more critical than ever. When you join SentinelOne, your work helps protect global enterprises, critical infrastructure, and the technologies shaping tomorrow. If you are motivated by meaningful challenges and want your impact to be real, measurable, and global, you will find purpose here.

SentinelOne is a company at the intersection of AI and security, pioneering a new operating model for cybersecurity. Our AI-native platform unifies protection across endpoint, cloud, identity, data, and AI systems to deliver autonomous detection and response with clarity and speed. By combining real-time analytics, intelligent automation, and a unified data foundation, we reduce noise, simplify complexity, and empower security teams to focus on what truly matters.

Our teams are builders, problem-solvers, and innovators committed to shaping the future of security. If you are excited to solve hard problems alongside talented, mission-driven people, we invite you to help us build a safer future for humanity.

What Are We Looking For?

We’re looking for people who are relentlessly curious and committed to continuous learning. AI is reshaping every function across our business, and we enable every team member, regardless of role or level, to build fluency in AI tools and concepts. Those who thrive here actively seek out new solutions, experiment thoughtfully, and apply what they learn to drive better, faster, smarter outcomes.

As a Principal Software Engineer, AI SIEM, you will be tasked with reasoning across all three layers of SentinelOne's AI SIEM: how data moves and gets queried at scale, how analysts actually work with what the system surfaces, and how detections get built and tuned. Our AI SIEM ingests petabytes of data per day, powers the analyst workflows that turn that data into alerts, findings, assets, and incidents, and drives the detection engines, both rule-based and AI-driven, that catch what matters. You will look at the system as a whole, find where it's exceptional, where it has gaps, where it has redundant or overlapping effort, and drive the architectural decisions that close those gaps.

This is not a role scoped to one service or one team's backlog. It's for someone who can sit above the individual pillars, understand how they're supposed to fit together, and act when they don't.

What Will You Do?

• Build a working mental model of the full system, including ingest and storage, query and retrieval, analyst-facing workflows (alerts, findings, assets, incidents), and the detection engines (rule-based and beyond), and use it to identify where architecture is solid, where it's fragile, and where teams are unknowingly duplicating effort or leaving gaps between their boundaries.

• Drive cross-team architectural decisions that affect multiple parts of the system at once, for example, how ingest-time enrichment should relate to detection logic, or how detection output should shape what an analyst sees and can act on.

• Partner with the engineering leads of each pillar (data platform, analyst experience, detection engines) as a peer thought partner, not a top-down authority, influencing through technical credibility and clear reasoning, not mandate.

• Identify and prioritize the highest-leverage architectural investments across the system, and make the case for them to engineering leadership and product.

• Get hands-on where it matters: prototype, review, and occasionally build the connective tissue between pillars when no single team naturally owns