Senior Detection & Response Engineer
Employment Information
Report this job
Job expired or something wrong with this job?
Job Description
Senior Detection & Response Engineer owning Microsoft security detections at Expel, which provides transparent managed detection and response. Mapping telemetry, automating investigations, and improving customer coverage.
Responsibilities:
- Own detection coverage across Defender XDR, Entra ID, Sentinel, Microsoft Graph, Azure, and Microsoft 365, from raw signal through shipped and tuned detections
- Build and maintain a living map of Microsoft security signals, including ingestion lag, destinations, licensing gates, retention, and reliability
- Track signal changes and turn material changes into concrete actions to prevent detection drift
- Assess Microsoft's native detections and identify where Expel needs its own detection layer
- Automate Microsoft-specific investigative workflows against Graph, Defender, Sentinel, and Entra APIs
- Partner with Engineering on Microsoft integrations, ingestion, API limits, throttling, and schema mapping
- Answer technical questions from SOC, Customer Success, and Sales teams and mentor colleagues
- Help customers understand their coverage, gaps, and the value of enabling additional capabilities
Requirements:
- Deep, current, hands-on knowledge of Defender XDR, Entra ID, Sentinel, Microsoft Graph, Azure, and Microsoft 365 control and data planes
- Fluency in KQL, including writing, reading, optimizing, and debugging non-trivial hunting queries across Defender Advanced Hunting and Sentinel
- Working knowledge of Graph, Graph Security, Defender, and Sentinel APIs, including authentication, permissions, versioning, and throttling models
- Strong understanding of Entra ID and legacy Active Directory identity attack surfaces and related telemetry
- Solid understanding of Windows internals and command line tooling, with enough macOS and Linux knowledge for cross-platform coverage
- Experience writing, deploying, and tuning custom detections against Microsoft datasets
- Exposure to AWS, GCP, and other EDR and SIEM platforms
- Proficiency with Python and Sigma
- Fluency using Anthropic tools such as Claude Code, locally and via MCP
- 5+ years in information technology or security operations, with substantial experience defending or operating Microsoft environments
- Excellent tact and diplomacy skills
- SC-200, AZ-500, or SC-300 certification is a plus
- Must be authorized to work in the United States
- Expel does not currently sponsor immigration visas
Benefits:
- Bonus eligibility
- Equity
- Unlimited PTO
- Work location flexibility
- Up to 24 weeks of parental leave
- Excellent health benefits
- Reasonable accommodation for disabilities
Similar Jobs
Field Project Engineer
Field Project Engineer deploying distributed-generation systems for AGent Energy. Leading customer sites from survey through go-live, contractor coordination, utility access, and onsite troubleshooting.
Platform Tooling Engineer
Platform tooling engineer managing monitoring platforms, incidents, and ServiceNow tickets for Presidio’s managed technology services. Troubleshooting enterprise infrastructure and supporting client-facing solutions.
Industrial Engineer
Industrial Engineers evaluating AI-generated production systems, quality analyses, and workflows for Mercor. Improving frontier AI models through expert industrial-engineering feedback.
Principal Equipment Engineer, Adhesion & Assembly
Principal Equipment Engineer developing advanced assembly, robotics, and automation equipment for RTX aerospace manufacturing. Delivering scalable production solutions across multiple sites.
Senior VDI / Citrix Engineer
Senior Principal VDI/Citrix Engineer designing secure Citrix, AVD, and AWS WorkSpaces environments. Supporting GDIT’s technology and mission services for U.S. government, defense, and intelligence customers.
Engineer II – Relay Settings, System Protection
Relay Settings Engineer designing protective relaying and relay control schemes for Qualus, a power infrastructure solutions firm. Performing relay studies and supporting generation interconnections.
Industrial Hygienist / Process Safety Engineer
Industrial Hygienist / Process Safety Engineer red-teaming Mercor’s frontier AI models. Evaluating chemistry and chemical-safety responses for misuse risks.
Quantum Computing, Cryptography Engineer
Quantum cryptography engineer supporting PingWind’s federal government cybersecurity services. Developing post-quantum migration strategies and cryptographic modernization solutions.
Air Source Heat Pump Service and Repair Engineer
Clean energy technician servicing and repairing air source heat pumps and heating systems for Aira customers across the UK. Performing routine maintenance, reactive repairs, and component fault-finding.
Air Source Heat Pump Service and Repair Engineer
Clean energy technician servicing and repairing Aira air source heat pumps and heating systems. Supporting UK homeowners through scheduled maintenance, fault-finding, and reactive repairs.
Air Source Heat Pump Service and Repair Engineer
Senior technician servicing and repairing Aira’s air source heat pumps and heating systems. Maintaining clean-energy technology for homeowners across the UK.
Project Administrative Office Engineer
Project Administrative Office Engineer supporting Turner & Townsend’s commercial real estate programs. Coordinating documentation, schedules, reporting, governance, and project controls remotely.
Project Administrative Office Engineer
Project Administrative Office Engineer supporting Turner & Townsend’s commercial real estate projects across the United States. Coordinating documentation, schedules, reporting, governance, and project controls remotely.
Power Process Engineer
Part-time Power Process Engineer role at Hargrove, a global engineering and project-services company. Performing unspecified power-process engineering responsibilities in a virtual setting.
Technical Services Engineer III
Technical Services Engineer leading commissioning, building automation, and energy conservation for ENFRA’s Energy-as-a-Service projects. Guiding complex system integration, optimization, standards, and technical team mentorship.
Remediation Engineer
Remediation Engineer hardening infrastructure, managing Microsoft and Azure environments, and remediating vulnerabilities for CompassMSP managed-services clients.
Forward Deployed Engineer
Forward Deployed Engineer supporting goTenna’s off-grid mobile mesh networking products. Providing technical support, customer training, installations, and presales assistance for public safety and military customers.
Junior Technical Delivery Engineer
Junior Technical Delivery Engineer deploying Capacity/Verbio AI support automation solutions in customer environments. Troubleshooting Linux-based deployments and supporting customers, project managers, and senior engineers.
Industrial Electrical Maintenance Engineer
Engenheiro de manutenção elétrica industrial projetando sistemas de energia, UPS e contingência para ambientes de TI. Atuando com normas, comissionamento e infraestrutura tecnológica na Stefanini.
Staff Observability Engineer
Staff Observability Engineer designing AI observability and reliability systems for Tealium’s customer data platform. Building telemetry, SLOs, tracing, and cost controls across enterprise services.