Senior Detection & Response Engineer

Job not on LinkedIn

🔥 0 minutes ago

⚔️ Virginia – Remote

⚔️ Virginia – Remote

💵 $142.9k - $207.2k / year

⏰ Full Time

🟠 Senior

👷🏻‍♀️ Engineer

🦅 H1B Visa Sponsor

This company has sponsored H1B visas in the past.

👻 Ghost score 0%

What it means: how likely this posting is sitting open without active hiring.How to read it: 60% or higher means we think this is a ghost. Lower scores are less of a worry.How we score it: age, reposts, open roles vs team size, how fast jobs close, and whether pay is listed.Fine print: an estimate from public data, not a judgment of the company. Real jobs can score high, so treat it as a hint, not a fact.

Apply Now

Find Similar Remote Jobs

Set Up Email Alert For New Jobs

📊 Check your resume score for this job

Improve your chances of getting an interview by checking your resume score before you apply.

Upload Resume

Expel

WebsiteLinkedInAll Job Openings

201 - 500 employees

Founded 2016

🔒 Cybersecurity

☁️ SaaS

Cybersecurity • SaaS • Technology

Expel is a leading cybersecurity company specializing in Managed Detection and Response (MDR) services. They offer a range of solutions, including phishing investigation, threat hunting, and vulnerability prioritization, tailored for organizations of all sizes with 24x7 protection. Expel's Security Operations Platform, Expel Workbench™, integrates with existing tech to enhance security operations. Their expert team and advanced technology help reduce alert noise, respond swiftly to incidents, and improve overall security posture, enabling organizations to focus on core business activities without worrying about cybersecurity threats.

📋 Description

• Own detection coverage across Defender XDR, Entra ID, Sentinel, Microsoft Graph, Azure, and Microsoft 365, from raw signal through shipped and tuned detections • Build and maintain a living map of Microsoft security signals, including ingestion lag, destinations, licensing gates, retention, and reliability • Track signal changes and turn material changes into concrete actions to prevent detection drift • Assess Microsoft's native detections and identify where Expel needs its own detection layer • Automate Microsoft-specific investigative workflows against Graph, Defender, Sentinel, and Entra APIs • Partner with Engineering on Microsoft integrations, ingestion, API limits, throttling, and schema mapping • Answer technical questions from SOC, Customer Success, and Sales teams and mentor colleagues • Help customers understand their coverage, gaps, and the value of enabling additional capabilities

🎯 Requirements

• Deep, current, hands-on knowledge of Defender XDR, Entra ID, Sentinel, Microsoft Graph, Azure, and Microsoft 365 control and data planes • Fluency in KQL, including writing, reading, optimizing, and debugging non-trivial hunting queries across Defender Advanced Hunting and Sentinel • Working knowledge of Graph, Graph Security, Defender, and Sentinel APIs, including authentication, permissions, versioning, and throttling models • Strong understanding of Entra ID and legacy Active Directory identity attack surfaces and related telemetry • Solid understanding of Windows internals and command line tooling, with enough macOS and Linux knowledge for cross-platform coverage • Experience writing, deploying, and tuning custom detections against Microsoft datasets • Exposure to AWS, GCP, and other EDR and SIEM platforms • Proficiency with Python and Sigma • Fluency using Anthropic tools such as Claude Code, locally and via MCP • 5+ years in information technology or security operations, with substantial experience defending or operating Microsoft environments • Excellent tact and diplomacy skills • SC-200, AZ-500, or SC-300 certification is a plus • Must be authorized to work in the United States • Expel does not currently sponsor immigration visas

🏖️ Benefits

• Bonus eligibility • Equity • Unlimited PTO • Work location flexibility • Up to 24 weeks of parental leave • Excellent health benefits • Reasonable accommodation for disabilities