Compromise Assessments – Engagement Manager

SentinelOne

10d•$132,000 - $160,000•Remote

About The Position

As an Engagement Manager on the Compromise Assessments (CA) team, you'll be tasked with managing the delivery of consulting-style engagements to SentinelOne customers, serving as the critical link between our threat hunters, customers, and internal stakeholders. Engagements deliver telemetry-driven threat hunts (M&A, Post-Breach, Insider Threat, etc.). You'll own each assessment's full operational lifecycle, from intake and scoping through delivery, working alongside fellow Engagement Managers. You'll serve as the primary executive-facing point of contact, comfortably pivoting between our threat hunters and discussions with customer stakeholders. This is a technical-based role: practitioner-level technical knowledge is core to it, used to QC threat hunter analysis and reporting, serve as a knowledge resource for customers and internal teams, and provide surge capacity when needed. Over time, EMs on this team may also support engagements delivered through our AI-accelerated source code vulnerability assessment offering as capacity requires.

Requirements

5+ years of hands-on practitioner experience in threat hunting, security analysis, or incident response, including some engagement or project management experience in a cybersecurity consulting, incident response, or related security services delivery role.
Deep technical expertise in endpoint telemetry analysis and threat hunting. This depth is core to the role — used to QC findings, answer customer technical questions, and provide surge capacity.
Strong staffing and resource-coordination skills, excellent client communication, and comfort working with executive stakeholders, account teams, and, where applicable, legal counsel.
Demonstrated experience owning customer escalations end-to-end and contributing to team documentation and process improvement.
An evident self-starter, comfortable with collaborative working with fellow Engagement Managers.
Ability to translate complex technical findings to business impact for non-technical stakeholders.

Nice To Haves

Support engagements delivered through our AI-accelerated source code vulnerability assessment offering as capacity requires.

Responsibilities

Oversee telemetry-based compromise assessment engagements from intake through delivery, ensuring quality, timely deliverables, and adherence to engagement minimums and scoping standards.
Lead scoping and business development activities — requirements gathering and coordinating telemetry access — with clear communication to customers, account teams, and assigned threat hunters.
Staff our threat hunters onto engagements based on scope and availability, and monitor team capacity to keep workload balanced.
Oversee the customer communication cadence throughout each engagement — status updates and review calls — and own customer escalations end-to-end.
Oversee evidence and data handling during the engagement, and manage retention and deletion timelines at closure, including any customer requests for early deletion.
Serve as a knowledge resource — for customers and internally — on CA's services and capabilities, and drive process improvement by maintaining internal documentation and iterating on our delivery playbook as gaps surface.
Manage each engagement's retainer hour budget, tracking usage against scope and requesting uplifts where needed.
QC technical analysis and reports before delivery, and step in as hands-on surge support for telemetry analysis when team capacity requires it.