Staff Threat Researcher

About Us

At SentinelOne, we’re redefining cybersecurity by pushing the limits of what’s possible—leveraging AI-powered, data-driven innovation to stay ahead of tomorrow’s threats.

From building industry-leading products to cultivating an exceptional company culture, our core values guide everything we do. We’re looking for passionate individuals who thrive in collaborative environments and are eager to drive impact. If you’re excited about solving complex challenges in bold, innovative ways, we’d love to connect with you.

What are we looking for?

We are seeking a highly motivated and skilled individual to join our team as a Staff Threat (Intelligence) Researcher. The ideal new colleague should have a solid background in cybercrime investigation/threat research - incl. especially Linux and/or Cloud, and malware analysis. You will be responsible for conducting in-depth research and analysis of emerging and existing threats, provide actionable intelligence for detection, and will leverage your deep understanding of the tactics, techniques, and procedures used by ransomware operators and their ecosystem.

What You’ll Do?

• Lead threat intelligence initiatives to proactively research, analyze, and assess emerging cyber threats, including ransomware groups, financially motivated actors with a focus on developing detection strategies.
• Perform in-depth technical threat analysis, including malware reverse engineering (static/dynamic), campaign tracking, and infrastructure profiling, to inform and drive detection logic in endpoint detection and response (EDR) platforms.
• Develop high-fidelity detection logic (YARA, platform rules etc) based on actionable intelligence derived from malware capabilities, actor TTPs, and behavioral patterns observed in telemetry and forensic artifacts.
• Design and implement threat hunting strategies to proactively discover malicious activity, unearth novel attack patterns, and surface IOCs  and BOIs across diverse environments.
• Continuously curate and maintain a threat intelligence knowledge base, including actor profiles, toolsets, infrastructure usage, TTPs, and affiliations, with a special focus on tracking ransomware and their evolving ecosystems.
• Monitor adversary infrastructure (C2s, exploit servers), and develop automated methods to fingerprint and track infrastructure reuse across campaigns.
• Collaborate with detection engineers to align threat research with detection coverage gaps
• Produce actionable intelligence reports and detection recommendations for internal stakeholders, including concise executive briefings and deep technical analysis for detection engineering and response teams.
• Stay ahead of the curve on malware trends, evasive techniques, and novel TTPs, and map findings to threat models (e.g., MITRE ATT&CK, Diamond Model) to maintain contextual awareness and detection depth.
• Mentor and guide detection engineers, promoting a culture of continuous learning, collaboration, and threat-informed defense.

What experience or knowledge should you bring?

• Expertise in malware analysis (both static and dynamic), reverse engineering, unpacking, and deobfuscation using tools like IDA Pro, Ghidra, x64dbg, and behavioral sandboxes (Cuckoo, CAPE, etc.).
• Strong understanding of endpoint security technologies, especially EDR platforms and the internal workings of how detection signals are generated and triaged.
• Deep knowledge of operating system internals (Windows, Linux), including memory management, process/thread architecture, registry, and system calls. Familiarity with Extended Berkeley Packet Filter (eBPF) and container security is highly valued.
• Knowledge of cloud threat landscape, and threats and attacks targeting Linux, containers, and K8s.
• Experience with cloud security research/ cloud threat hunting or IR/ cloud pentesting or redteaming; and with cloud threat detection and cloud-native telemetry (AWS, Azure, GCP). 
• Proficient in threat intelligence frameworks and methodologies, including the Diamond Model, MITRE ATT&CK, Kill Chain, and mapping TTPs to coverage and detection gaps.
• Strong data analysis and pattern recognition skills, able to sift through telemetry, logs, and artifacts to derive meaningful insights that drive detection hypotheses and logic.
• Skilled in programming/scripting for automation, analysis, and detection logic generation (mostly Python)
• Experience building and maintaining threat hunting playbooks, leveraging endpoint telemetry, behavior analytics, and threat intelligence to operationalize continuous threat detection.
• Comprehensive understanding of threat actor behaviors, intrusion sets, and motivations and their tooling/ecosystem.

Nice-to-Have Skills and Qualifications:

• Relevant certifications such as GIAC GREM, CREA, CMA, OSCE3, or RECA.
• Familiarity with CTI enrichment platforms and tooling, such as MISP, ThreatConnect, or commercial TIPs.
• Practical experience in building detection pipelines, integrating threat intelligence with SIEM/EDR platforms.
• Contributions to open-source tools, YARA rulesets, or CTI repositories.
• Authored some blogs

Why Us? 

Join a cutting-edge company tackling extraordinary challenges alongside top industry talent. Enjoy flexible hybrid work in Prague (Karlin), Brno (Clubco), or remotely across CZ/SK. Only Prague-based employees are required to work from the office at least two days per week.

Competitive Benefits Package:

• Stock & Bonuses: Grant of Restricted Stock Units with a 4-year vesting plan, annual performance-based bonuses, and an employee stock purchase plan.
• Time Off & Well-being: Flexible Time Off, on top of the standard 5 weeks vacation, flexible paid sick days, fully paid Short Term Sick/Nursing Leave, 16-week parental leave, grandparent leave, and additional company holidays.
• Insurance & Health: Pension Insurance Contribution, Premium life insurance, Private medical care (for you and +1), and a Global Employee Assistance Program.
• Work Perks: Monthly meal and well-being allowance, high-end MacBook/Windows laptop, work-from-home support, and in-office refreshments.
• Growth & Community: LinkedIn Learning, internal mentoring, educational support, generous referral bonuses, and optional company events (sports, BBQs, charity).

Be part of an inclusive, innovative workplace that values belonging, flexibility, and growth!

SentinelOne is proud to be an Equal Employment Opportunity and Affirmative Action employer. We do not discriminate based upon race, religion, color, national origin, gender (including pregnancy, childbirth, or related medical conditions), sexual orientation, gender identity, gender expression, age, status as a protected veteran, status as an individual with a disability, or other applicable legally protected characteristics.

SentinelOne participates in the E-Verify Program for all U.S. based roles.