Work Hard EverywhereJob Description
Headquarters: Remote
You're the detection engineer people turn to when they ask "what does Microsoft actually see here?" Not the marketing-slide answer, the real map. Which product emits which telemetry, any anticipated ingestion lags, what table or API it lands in, which license tier gates it, how long it survives before it ages out, and where the documentation quietly disagrees with reality. When a new technique drops, your first instinct is to ask which Microsoft signal would catch it, and whether customers have it switched on.
You also know Microsoft never sits still. Hunting tables appear, columns get renamed, Graph versions retire, capability shuffles between SKUs, previews go GA, features quietly vanish, and native alert logic shifts underneath you. You've got a repeatable way of staying ahead of that churn instead of finding out when a detection stops firing. You're comfortable behind a command line and in front of a customer, including scenarios where the conversation isn’t pleasant. If that's you, we'd love to talk! We have an amazing team and believe you'll love getting to know us.
At Expel, we help businesses bridge the cybersecurity talent gap by providing transparent Managed Detection and Response. To do this we build technology to make sure our security analysts are solving important problems, and automation is helping them make better decisions at every step. We delight in using technology to make security accessible for our customers.
What Expel can do for you
- Make you one of our recognized authorities on Microsoft detection and response - for our SOC, our engineers, our go-to-market teams, and our customers
- Give you real ownership of Expel's detection coverage across the whole Microsoft security estate
- Put Microsoft telemetry from across our customer base in front of you - a breadth of real-world environments no single enterprise gets to see
- Let you write and tune detections in our own rule engine and watch them run against live...
You're the detection engineer people turn to when they ask "what does Microsoft actually see here?" Not the marketing-slide answer, the real map. Which product emits which telemetry, any anticipated ingestion lags, what table or API it lands in, which license tier gates it, how long it survives before it ages out, and where the documentation quietly disagrees with reality. When a new technique drops, your first instinct is to ask which Microsoft signal would catch it, and whether customers have it switched on.
You also know Microsoft never sits still. Hunting tables appear, columns get renamed, Graph versions retire, capability shuffles between SKUs, previews go GA, features quietly vanish, and native alert logic shifts underneath you. You've got a repeatable way of staying ahead of that churn instead of finding out when a detection stops firing. You're comfortable behind a command line and in front of a customer, including scenarios where the conversation isn’t pleasant. If that's you, we'd love to talk! We have an amazing team and believe you'll love getting to know us.
At Expel, we help businesses bridge the cybersecurity talent gap by providing transparent Managed Detection and Response. To do this we build technology to make sure our security analysts are solving important problems, and automation is helping them make better decisions at every step. We delight in using technology to make security accessible for our customers.
What Expel can do for you
- Make you one of our recognized authorities on Microsoft detection and response - for our SOC, our engineers, our go-to-market teams, and our customers
- Give you real ownership of Expel's detection coverage across the whole Microsoft security estate
- Put Microsoft telemetry from across our customer base in front of you - a breadth of real-world environments no single enterprise gets to see
- Let you write and tune detections in our own rule engine and watch them run against live...