Senior Detection & Response Engineer

About the Role

At Expel, we help businesses bridge the cybersecurity talent gap by providing transparent Managed Detection and Response. We are seeking a Senior Detection & Response Engineer who has deep, authoritative knowledge of the Microsoft security ecosystem—understanding telemetry emission, ingestion lags, API/table landing spots, licensing gates, data retention, and how documentation compares to reality.

What You Can Do for Expel

• Own our detection coverage across Defender XDR, Entra ID, Sentinel, Microsoft Graph, Azure, and Microsoft 365—from raw signal through to shipped, tuned detections.
• Build and maintain a living map of Microsoft security signal: what exists, known ingestion lag, where it lands, what gates it, how long it's kept, and how far you can trust it.
• Track how that signal changes and turn every material change into a concrete action—catching drift before it costs us efficacy.
• Tell us where Microsoft's native detections are strong enough to lean on, where they're noisy or shallow, and where Expel needs its own layer.
• Make SOC analysts faster by automating Microsoft-specific investigative workflows against the Graph, Defender, Sentinel, and Entra APIs.
• Partner with Engineering on our Microsoft integrations—ingestion, API limits and throttling, and schema mapping.
• Answer the hard questions from the SOC, CS, and Sales—and mentor the people asking them.
• Help customers understand what they're actually covered for, what they're missing, and what turning it on would buy them.

Qualifications

• 5+ years in information technology or security operations, with substantial time spent defending or operating Microsoft environments.
• Deep, current, hands-on knowledge of the Microsoft security stack: Defender XDR (Endpoint, Identity, Office 365, Cloud Apps), Entra ID, Sentinel, Microsoft Graph, and the Azure and Microsoft 365 control and data planes.
• Fluency in KQL: ability to write, read, optimize, and debug non-trivial hunting queries across both Defender Advanced Hunting and Sentinel, understanding schema differences.
• Working knowledge of the Graph and Graph Security APIs, the Defender and Sentinel APIs, and their authentication, permission, versioning, and throttling models.
• Strong grasp of the Entra ID (and legacy Active Directory) identity attack surface, including authentication flows, conditional access, OAuth application consent, token theft and replay, hybrid identity/sync, and privileged role abuse.
• Solid understanding of Windows internals and command line tooling, with enough macOS and Linux knowledge to support cross-platform coverage.
• Experience writing, deploying, and tuning custom detections against Microsoft data sets, plus exposure to non-Microsoft platforms (AWS, GCP, other EDR and SIEM).
• Proficiency with Python and Sigma, and fluency using Anthropic tools such as Claude Code across systems and data (locally, via MCP, etc.).
• Excellent tact and diplomacy skills to communicate constraints and limits effectively.
• SC-200, AZ-500, or SC-300 certifications are a plus.