Principal Software Engineer, AI SIEM

Details

SentinelOne is seeking a Principal Software Engineer, AI SIEM, to reason across all three layers of its AI SIEM platform: large-scale data movement and querying, analyst workflows, and detection engines. The platform ingests petabytes of data per day and powers alerts, findings, assets, incidents, and both rule-based and AI-driven detection systems.

The role is responsible for understanding how the system's pillars fit together, identifying architectural strengths and gaps, reducing redundant effort, and driving decisions that improve the overall system. This is a cross-system role rather than one limited to a single service or team backlog.

Responsibilities

• Build a working mental model of the full system, including ingest and storage, query and retrieval, analyst-facing workflows, and rule-based and AI-driven detection engines.
• Identify architectural strengths, fragility, duplicated effort, and gaps between team boundaries.
• Drive cross-team architectural decisions affecting data ingest, enrichment, detection logic, and analyst-facing outputs.
• Partner with engineering leads across the data platform, analyst experience, and detection engine pillars as a peer thought partner.
• Identify and prioritize high-leverage architectural investments and communicate their value to engineering leadership and product teams.
• Prototype, review, and occasionally build connective services or components when no single team owns them.
• Establish and champion technical standards for APIs, data contracts, and service boundaries.
• Mentor senior and staff engineers across teams and raise the standard of architectural thinking across the organization.
• Represent the technical health of the overall system in planning and leadership discussions.

Requirements

• 15 or more years of experience building and operating large-scale distributed backend systems.
• Direct experience in at least two of the following areas: high-throughput data ingest and storage, query engines, or detection and rules systems.
• Demonstrated ability to reason about systems at the architecture level, including identifying incorrect boundaries, overlapping responsibilities, and gaps.
• Experience designing APIs and service contracts that remain effective across teams and over multiple years.
• Ability to influence peer teams and senior engineers without a single clear chain of command.
• Four-year degree in Computer Science or equivalent practical experience.
• Familiarity with security operations concepts, including alerts, findings, assets, incidents, and detection rules, is preferred.
• Experience with modern cloud infrastructure and data-intensive systems, including distributed storage, high-cardinality querying, and streaming pipelines, is preferred.
• Exposure to both rule-based and machine learning or AI-driven detection approaches is a plus.

Benefits

• Restricted Stock Units (RSUs)
• Employee Stock Purchase Plan (ESPP)
• Flexible time off, paid company holidays, and paid sick time
• Gender-neutral parental leave and grandparent leave
• Medical, dental, and vision coverage
• 401(k) retirement plan with company match
• Life and disability insurance
• Health and dependent care FSA
• Voluntary benefits, Employee Assistance Program, prepaid legal services, pet insurance, Cancer Care program, and global business travel medical insurance
• Home office allowance and mobile phone reimbursement
• Wellness coach, wellness or gym reimbursement, fertility coverage, and adoption or surrogacy reimbursement

This U.S. role has a base salary range of $216,000–$297,000 USD, with location-based variations possible.