Detection & Response Engineer

November 21

Apply Now

Receive Emails with Similar Jobs

Expel

WebsiteLinkedInAll Job Openings

Cybersecurity • SaaS • Technology

Expel is a leading cybersecurity company specializing in Managed Detection and Response (MDR) services. They offer a range of solutions, including phishing investigation, threat hunting, and vulnerability prioritization, tailored for organizations of all sizes with 24x7 protection. Expel's Security Operations Platform, Expel Workbench™, integrates with existing tech to enhance security operations. Their expert team and advanced technology help reduce alert noise, respond swiftly to incidents, and improve overall security posture, enabling organizations to focus on core business activities without worrying about cybersecurity threats.

201 - 500 employees

Founded 2016

🔒 Cybersecurity

☁️ SaaS

📋 Description

• Implement, maintain and iteratively improve Expel's ability to detect and investigate threats using integrated technologies with limited direction • Contribute to the growth of Expel’s detection strategy and capability through creation of detections for Expel’s proprietary rule engine. • Maintain documentation in support of Expel’s detection and response content • Improve SOC analyst efficiency by automating investigative workflows using an orchestration framework written in Python. • Evaluate technology APIs to design detection and response solutions to contribute to improving the value and efficiency in Expel’s Workbench platform. • Contribute to and thrive in a culture of experimentation, agile, quality and continuous improvement among the team. • Participate in the team’s research and monitoring of the latest threat landscape and subsequent detection and response automation development.

🎯 Requirements

• 1+ years of experience with detection and response tools, particularly EDR, NSM, and SIEM. • 1+ years of experience writing, deploying and tuning custom detections based on research or investigative work against common data sets (Windows Event Logs, auditd, CloudTrail, and similar datasets.) • Proficiency of Python, Go or other object oriented programming languages • Strong understanding of Windows, macOS and Linux operating systems and command line tools. • Knowledge of networking basics, such as TCP/IP and OSI model. • Working knowledge and observations of attack vectors, threat tactics, and attacker techniques. • Understanding of cloud infrastructure platforms and their Identity and Access Management (IAM) models. • Bachelor’s degree in Computer Science or Information Security strongly preferred. • 3+ years of professional experience in information technology or security operations would be ideal but not required.

🏖️ Benefits

• unlimited PTO (which we model and encourage) • work location flexibility • up to 24 weeks of parental leave • really excellent health benefits