Senior Detection & Response Engineer

📋 Description

• Own our detection coverage across Defender XDR, Entra ID, Sentinel, Microsoft Graph, Azure, and
• Build and maintain a living map of Microsoft security signal: what exists, known ingestion lag
• Track how that signal changes and turn every material change into a concrete action — catching
• Tell us where Microsoft's native detections are strong enough to lean on, where they're noisy or
• Make SOC analysts faster by automating Microsoft-specific investigative workflows against the
• Partner with Engineering on our Microsoft integrations — ingestion, API limits and throttling, and

🎯 Requirements

• Deep, current, hands-on knowledge of the Microsoft security stack — Defender XDR (Endpoint
• Fluency in KQL: you can write, read, optimize, and debug non-trivial hunting queries across both
• Working knowledge of the Graph and Graph Security APIs, the Defender and Sentinel APIs, and their
• A strong grasp of the Entra ID (and legacy Active Directory) identity attack surface —
• Solid understanding of Windows internals and command line tooling, with enough macOS and Linux to
• Experience writing, deploying, and tuning custom detections against Microsoft data sets, plus

🎁 Benefits

• Make you one of our recognized authorities on Microsoft detection and response — for our SOC, our
• Give you real ownership of Expel's detection coverage across the whole Microsoft security estate
• Put Microsoft telemetry from across our customer base in front of you — a breadth of real-world
• Let you write and tune detections in our own rule engine and watch them run against live signal
• Treat AI tooling (Claude Code and friends) as a first-class part of how you work, not a side
• Enable you to learn from analysts, data scientists, engineers, and responders responsible for