Senior Detection & Response Engineer

Senior detection and response engineer at Expel who owns detection coverage across the Microsoft security estate for the company's managed detection and response service: Defender XDR, Entra ID, Sentinel, Microsoft Graph, Azure and Microsoft 365. Remote in the US.

The engineer keeps a living map of Microsoft security telemetry, including where it lands, what licence gates it and how long it is kept, tracks changes before they break detections, writes and tunes rules in Expel's engine, judges where native Microsoft detections suffice, automates SOC investigations through Microsoft APIs, and advises customers and internal teams. Expel wants five or more years defending or running Microsoft environments, fluent KQL, deep knowledge of Entra ID attack paths, Python and Sigma skills, and real use of AI tools such as Claude Code.