DFIR – Engagement Manager

***USA (Pacific, Mountain, Alaska, or Hawaii time zones)***

SentinelOne’s Digital Forensics and Incident Response (DFIR) team delivers rapid, expert breach response to global enterprises facing active cyber threats — including ransomware, business email compromise, identity compromise, zero-day exploitation, APT activity, and cloud/SaaS breaches. As an Engagement Manager (EM), you'll own the full lifecycle of DFIR investigations — from scoping and staffing through budget management and delivery. You will serve as the primary point of contact between our DFIR analysts and all stakeholders, including account teams, customer executives, breach counsel, and cyber insurance carriers. You'll move comfortably between technical detail and executive-level conversations during high-stakes incidents.

Your exceptional communication and project management skills drive the engagement lifecycle, backed by practitioner-level DFIR knowledge. You will provide valuable technical expertise by partnering with investigation technical leads to align on analytical focus and findings, and providing hands-on surge support for data collection and forensic analysis as needed. This role also requires U.S. citizenship and FedRAMP eligibility to support occasional investigations for our FedRAMP customers.

What Will You Do?

Primary responsibilities include:

• Oversee active DFIR investigations end-to-end, ensuring exceptional quality, timely deliverables, and appropriate resource allocation.
• Staff analysts onto engagements based on scope, skillset, and availability, and monitor team capacity to keep workload balanced.
• Lead scoping and business development activities — incident intake, requirements gathering, and SOW/tri-party development.
• Manage each engagement's retainer hour budget, tracking usage against scope and coordinating uplift or overage conversations with customers and account teams.
• Establish and own clear communication channels across all investigation stakeholders, including internal teams, customers, external breach counsel, and cyber insurance carriers.
• Own escalations end-to-end, resolving technical or operational challenges.
• Oversee case documentation, evidence handling, and chain of custody, and manage retention and deletion timelines at engagement closure, including customer requests for early deletion.
• Work with each case’s technical lead to shape investigative direction and validate findings, and ensure workstreams meet customer expectations and reporting standards.
• Ensure strict adherence to standard operating procedures and incident response best practices.
• Manage the delivery of timely, accurate status updates and recommendations to customers and stakeholders throughout the engagement.
• Act as hands-on surge support and conduct technical analysis as needed to maintain investigative momentum when team capacity requires it.
• Lead post-engagement reviews and drive process improvement initiatives to optimize team workflows.
• Participate in a rotating on-call schedule for weekends and holidays, to support active incident response.

What Skills and Knowledge Will You Bring?

Ideal candidates will have: 

• 5+ years of hands-on consulting experience in digital forensics and incident response, including engagement or project management experience in a cybersecurity consulting or IR services delivery role.
• Bachelor's or Master's degree in Digital Forensics, Cybersecurity, Computer Science, or a related technical field (or equivalent practical self-study).
• Industry certifications (GCFE, GCFA, GREM, CFCE, EnCE, or similar).
• Proven track record of managing complex, multi-stakeholder incident response engagements.
• Excellence in client communication and relationship management, with comfort working with executive stakeholders, legal counsel, and insurance carriers.
• Ability to translate complex technical findings into business impact for non-technical stakeholders.
• Expert-level experience with industry-standard forensic tools and methodologies.
• Strong understanding of and experience with EDR/XDR platforms and security technologies.
• Strong staffing, resource-coordination, and team leadership skills.
• An evident self-starter with intellectual curiosity and the ability to adapt to change.
• Requires U.S. citizenship and FedRAMP eligibility.

Nice to Have:

• Experience conducting malware analysis and memory forensics.
• Demonstrated experience in endpoint-based threat-hunting and compromise assessments.
• Experience working with cyber threat intelligence platforms and processes.
• Active participation in the security community through speaking engagements or publications.

Why SentinelOne?

AI is redefining how the world operates and rewriting the rules of security in real time, and SentinelOne was built for this moment. From day one, we architected an AI-native platform designed to operate at machine speed, not as an add-on to legacy systems but as the foundation itself. If you want to build where innovation and impact move together, this is that place.

We invest in our Sentinels with comprehensive, competitive benefits designed to support you and your family:

Equity & Rewards

• Restricted Stock Units (RSUs)
• Employee Stock Purchase Plan (ESPP)

Time Off & Wellbeing

• Flexible time off
• Paid company holidays and paid sick time
• Gender-neutral parental leave
• Grandparent leave

Insurance & Financial Security

• Medical, dental, and vision coverage
• 401(k) retirement plan with company match
• Life and disability insurance
• Health and dependent care FSA
• Voluntary benefits (hospital, accident, critical illness)
• Employee Assistance Program (EAP)
• ARAG pre-paid legal
• Nationwide pet insurance
• Cancer Care program
• Global business travel medical insurance

Work Perks & Flexibility

• Home office allowance
• Mobile phone reimbursement

Wellness & Lifestyle

• Wellness coach
• Wellness/gym reimbursement
• Fertility coverage
• Adoption & surrogacy reimbursement