Principal Software Engineer, AI SIEM

at SentinelOne

📍 United States

USD 216,000-297,000 per year

SENIOR

✅ Remote

Tech Stack
Tag name is followed by "@" symbol and proficiency level value. About proficiency levels:

1-2 — basic awareness. Minimal hands-on experience, and a rudimentary understanding of the technology's purpose;

3-6 — daily use. Comfortable and regular usage, capable of handling common tasks and challenges related to the technology;

7-9 — you are an expert, you can teach others, you know all the pitfalls and tricks;

10 — exceptional knowledge, comprehensive understanding, and adeptness in all aspects of the technology, including advanced problem-solving. Think twice before claiming or demanding such level.

AI @ 6 API @ 4 Leadership @ 9 Machine Learning Security @ 3

Details

As a Principal Software Engineer, AI SIEM, you will reason across all three layers of SentinelOne's AI SIEM: how data moves and gets queried at scale, how analysts work with what the system surfaces, and how detections get built and tuned. Your work will help power an AI SIEM that ingests petabytes of data per day, supports analyst workflows that turn data into alerts, findings, assets, and incidents, and drives detection engines (rule-based and AI-driven) that catch what matters.

Responsibilities

Build a working mental model of the full system, including ingest and storage, query and retrieval, analyst-facing workflows (alerts, findings, assets, incidents), and the detection engines (rule-based and beyond), using it to identify where architecture is solid, fragile, where teams are duplicating effort, and where gaps exist.
Drive cross-team architectural decisions affecting multiple parts of the system at once (e.g., how ingest-time enrichment relates to detection logic, or how detection output shapes what an analyst sees and can act on).
Partner with engineering leads of each pillar (data platform, analyst experience, detection engines) as a peer thought partner, influencing through technical credibility and clear reasoning.
Identify and prioritize the highest-leverage architectural investments across the system and make the case to engineering leadership and product.
Get hands-on where it matters: prototype, review, and occasionally build the connective tissue between pillars when no single team naturally owns it.
Establish and champion cross-cutting technical standards for APIs, data contracts, and service boundaries so independently developed pillars remain interoperable as they evolve.
Mentor senior and staff engineers across teams, raising the bar for architectural thinking org-wide.
Represent the technical health of the overall system in planning and leadership conversations, translating what is exceptional, a gap, or redundant into a roadmap.

Requirements

Deep experience (15 or more years) building and operating large-scale distributed backend systems, with direct experience in at least two of: high-throughput data ingest/storage, query engines, or detection/rules systems.
Demonstrated track record reasoning about systems at the architecture level (identifying boundaries that are wrong, responsibilities that overlap, and gaps).
Experience designing APIs and service contracts that hold up across teams and years.
Comfort operating without a single clear chain of command; influence peer teams and senior engineers through the strength of reasoning.
A four-year degree in Computer Science or equivalent practical experience.
Familiarity with security operations concepts (alerts, findings, assets, incidents, detection rules) is preferred; if you don't have direct SIEM/XDR background, you should be able to get fluent quickly.
Preferred: experience with modern cloud infrastructure and data-intensive systems (distributed storage, high-cardinality querying, streaming pipelines).
Exposure to both rule-based and ML/AI-driven detection approaches is a plus; the key trait is reasoning about when each is the right tool.