Remote opportunity at
ExpelSenior Detection & Response Engineer
Expel seeks a Senior Detection & Response Engineer to lead detection coverage across the entire Microsoft security ecosystem. This remote position involves mapping telemetry, building customized…
Career Tools
About This Role
Expel seeks a Senior Detection & Response Engineer to lead detection coverage across the entire Microsoft security ecosystem. This remote position involves mapping telemetry, building customized rules, tracking product modifications, and enhancing analytical workflows. The company provides transparent Managed Detection and Response to help clients close the cybersecurity talent gap. This role suits professionals who possess deep, current familiarity with Microsoft security products, KQL, identity attack surfaces, and modern tooling.…
Job Description
Expel seeks a Senior Detection & Response Engineer to lead detection coverage across the entire Microsoft security ecosystem. This remote position involves mapping telemetry, building customized rules, tracking product modifications, and enhancing analytical workflows. The company provides transparent Managed Detection and Response to help clients close the cybersecurity talent gap.
This role suits professionals who possess deep, current familiarity with Microsoft security products, KQL, identity attack surfaces, and modern tooling. Responsibilities include owning detection coverage across Microsoft 365, Defender XDR, Sentinel, Entra ID, and Azure, alongside assisting security operations centers, engineering teams, and customers with technical guidance.
Responsibilities
- Manage detection coverage across Defender XDR, Entra ID, Sentinel, Microsoft Graph, Azure, and Microsoft 365 from raw signal to shipped rules
- Maintain a comprehensive map of Microsoft security signals including ingestion lags, data retention, and licensing tiers
- Monitor signal modifications and adjust detection mechanisms to prevent drift and efficacy loss
- Evaluate native Microsoft detections to determine reliability and build independent layers when necessary
- Automate Microsoft-specific investigative workflows utilizing Graph, Defender, Sentinel, and Entra APIs to assist analysts
- Collaborate with engineering on Microsoft integrations, API limitations, throttling models, and schema mapping
- Address technical inquiries from the security operations center, customer success, and sales departments while mentoring team members
- Educate clients regarding their coverage levels, blind spots, and the impact of enabling specific features
Requirements
- At least 5 years of professional experience in information technology or security operations focused on defending or operating Microsoft environments
- Deep and current hands-on knowledge of the Microsoft security stack including Defender XDR, Entra ID, Sentinel, and Microsoft Graph
- Fluency in KQL for writing, reading, optimizing, and debugging hunting queries across Defender Advanced Hunting and Sentinel
- Working knowledge of Graph and Graph Security APIs, Defender and Sentinel APIs, along with authentication and throttling models
- Thorough understanding of the Entra ID and legacy Active Directory identity attack surfaces, authentication flows, and token theft
- Solid grasp of Windows internals and command line tooling, plus working knowledge of macOS and Linux
- Experience writing, deploying, and tuning custom detections for Microsoft data sets alongside non-Microsoft exposure in AWS, GCP, or other EDR and SIEM tools
- Proficiency in Python and Sigma, with fluency utilizing Anthropic tools such as Claude Code
- Strong tact and diplomacy capabilities to communicate security limitations to various audiences
- Authorized to work in the United States without visa sponsorship
Qualifications
- SC-200 certification
- AZ-500 certification
- SC-300 certification
Core Skills
Benefits
- Base salary range between $142,900 and $207,200 per year plus bonus eligibility and equity
- Unlimited paid time off
- Work location flexibility
- Up to 24 weeks of parental leave
- Health benefits
Frequently Asked Questions
Answers are based only on the employer’s listing; where it doesn’t say, neither do we.
Is this position remote?
Yes, remote work is available for this role, though the employer's headquarters is located in Herndon, Virginia.
What is the salary range for this role?
The base salary range is between $142,900 and $207,200 per year, with bonus eligibility and equity. The company primarily targets candidates between $160,000 and $192,000 based on experience.
What are the key technical requirements?
Candidates must have at least 5 years of IT or security operations experience, hands-on knowledge of the Microsoft security stack, KQL fluency, understanding of identity attack surfaces, Python and Sigma proficiency, and experience with Anthropic tools like Claude Code.
Does the company offer visa sponsorship?
The posting states that the company is only hiring individuals authorized to work in the United States and does not currently sponsor immigration visas.
Sample Interview Questions
AI-generated questions tailored to this specific role — a preview of the full practice set.