DFIR – Engagement Manager

SentinelOne

7d•$132,000 - $160,000•Remote

About The Position

SentinelOne’s Digital Forensics and Incident Response (DFIR) team delivers rapid, expert breach response to global enterprises facing active cyber threats — including ransomware, business email compromise, identity compromise, zero-day exploitation, APT activity, and cloud/SaaS breaches. As an Engagement Manager (EM), you'll own the full lifecycle of DFIR investigations — from scoping and staffing through budget management and delivery. You will serve as the primary point of contact between our DFIR analysts and all stakeholders, including account teams, customer executives, breach counsel, and cyber insurance carriers. You'll move comfortably between technical detail and executive-level conversations during high-stakes incidents. Your exceptional communication and project management skills drive the engagement lifecycle, backed by practitioner-level DFIR knowledge. You will provide valuable technical expertise by partnering with investigation technical leads to align on analytical focus and findings, and providing hands-on surge support for data collection and forensic analysis as needed. This role also requires U.S. citizenship and FedRAMP eligibility to support occasional investigations for our FedRAMP customers.

Requirements

5+ years of hands-on consulting experience in digital forensics and incident response, including engagement or project management experience in a cybersecurity consulting or IR services delivery role.
Bachelor's or Master's degree in Digital Forensics, Cybersecurity, Computer Science, or a related technical field (or equivalent practical self-study).
Industry certifications (GCFE, GCFA, GREM, CFCE, EnCE, or similar).
Proven track record of managing complex, multi-stakeholder incident response engagements.
Excellence in client communication and relationship management, with comfort working with executive stakeholders, legal counsel, and insurance carriers.
Ability to translate complex technical findings into business impact for non-technical stakeholders.
Expert-level experience with industry-standard forensic tools and methodologies.
Strong understanding of and experience with EDR/XDR platforms and security technologies.
Strong staffing, resource-coordination, and team leadership skills.
An evident self-starter with intellectual curiosity and the ability to adapt to change.
Requires U.S. citizenship and FedRAMP eligibility.

Nice To Haves

Experience conducting malware analysis and memory forensics.
Demonstrated experience in endpoint-based threat-hunting and compromise assessments.
Experience working with cyber threat intelligence platforms and processes.
Active participation in the security community through speaking engagements or publications.

Responsibilities

Oversee active DFIR investigations end-to-end, ensuring exceptional quality, timely deliverables, and appropriate resource allocation.
Staff analysts onto engagements based on scope, skillset, and availability, and monitor team capacity to keep workload balanced.
Lead scoping and business development activities — incident intake, requirements gathering, and SOW/tri-party development.
Manage each engagement's retainer hour budget, tracking usage against scope and coordinating uplift or overage conversations with customers and account teams.
Establish and own clear communication channels across all investigation stakeholders, including internal teams, customers, external breach counsel, and cyber insurance carriers.
Own escalations end-to-end, resolving technical or operational challenges.
Oversee case documentation, evidence handling, and chain of custody, and manage retention and deletion timelines at engagement closure, including customer requests for early deletion.
Work with each case’s technical lead to shape investigative direction and validate findings, and ensure workstreams meet customer expectations and reporting standards.
Ensure strict adherence to standard operating procedures and incident response best practices.
Manage the delivery of timely, accurate status updates and recommendations to customers and stakeholders throughout the engagement.
Act as hands-on surge support and conduct technical analysis as needed to maintain investigative momentum when team capacity requires it.
Lead post-engagement reviews and drive process improvement initiatives to optimize team workflows.
Participate in a rotating on-call schedule for weekends and holidays, to support active incident response.