高级检测与响应工程师
Senior Detection & Response Engineer
你是在别人问“微软实际看到了什么？”时，大家会找来的人。不是营销幻灯片上的答案，而是真实的地图。哪个产品发出哪种遥测数据，预期的摄入延迟，它落在哪个表或API中，哪个许可证层级限制了它，它在过期前能存活多久，以及文档与现实之间的差异在哪里。当一种新技术出现时，你的第一反应是询问哪个微软信号能检测到它，客户是否已经开启。
你也知道微软从不停止变化。狩猎表会出现，列名会被重命名，图版本会退役，功能会在SKU之间调整，预览版会转为正式版，某些功能会悄然消失，原生警报逻辑也会发生变化。你有可重复的方法来跟上这些变化，而不是等到检测失效才意识到问题。你能在命令行后和客户面前自如应对，包括一些不愉快的场景。如果你就是这样的角色，我们很期待与你交谈！我们有一个出色的团队，相信你会喜欢了解我们。
在Expel，我们通过提供透明的托管检测与响应服务，帮助企业弥合网络安全人才的缺口。为了实现这一点，我们构建技术，确保我们的安全分析师解决重要的问题，自动化帮助他们在每一步做出更好的决策。我们乐于使用技术让安全对我们的客户更加可及。
* * *
### **Expel能为你做什么**
- 让你成为我们认可的微软检测与响应权威——针对我们的SOC、工程师、市场团队和客户
- 让你对Expel在整个微软安全领域内的检测覆盖拥有真正的所有权
- 让你接触到来自我们客户群的微软遥测数据——这是任何单个企业都无法看到的广泛真实环境
- 让你使用我们自己的规则引擎编写和调整检测，并观察它们在实时信号上的运行情况
- 将AI工具（如Claude Code及其类似工具）作为你工作流程中的核心部分，而不是一个次要实验
- 使你能从负责Expel产品和服务各个组件的分析师、数据科学家、工程师和响应人员那里学习
- 提供对流行的EDR、网络、SIEM、身份和云技术的访问权限，远超微软技术栈
- 激励你推动我们安全愿景的边界
* * *
### **你能为Expel做什么**
- 负责我们整个微软安全领域的检测覆盖
查看英文原文
You're the detection engineer people turn to when they ask "what does Microsoft actually see here?" Not the marketing-slide answer, the real map. Which product emits which telemetry, any anticipated ingestion lags, what table or API it lands in, which license tier gates it, how long it survives before it ages out, and where the documentation quietly disagrees with reality. When a new technique drops, your first instinct is to ask which Microsoft signal would catch it, and whether customers have it switched on.
You also know Microsoft never sits still. Hunting tables appear, columns get renamed, Graph versions retire, capability shuffles between SKUs, previews go GA, features quietly vanish, and native alert logic shifts underneath you. You've got a repeatable way of staying ahead of that churn instead of finding out when a detection stops firing. You're comfortable behind a command line and in front of a customer, including scenarios where the conversation isn’t pleasant. If that's you, we'd love to talk! We have an amazing team and believe you'll love getting to know us.
At Expel, we help businesses bridge the cybersecurity talent gap by providing transparent Managed Detection and Response. To do this we build technology to make sure our security analysts are solving important problems, and automation is helping them make better decisions at every step. We delight in using technology to make security accessible for our customers.
* * *
### **What Expel can do for you**
- Make you one of our recognized authorities on Microsoft detection and response — for our SOC, our engineers, our go-to-market teams, and our customers
- Give you real ownership of Expel's detection coverage across the whole Microsoft security estate
- Put Microsoft telemetry from across our customer base in front of you — a breadth of real-world environments no single enterprise gets to see
- Let you write and tune detections in our own rule engine and watch them run against live signal
- Treat AI tooling (Claude Code and friends) as a first-class part of how you work, not a side experiment
- Enable you to learn from analysts, data scientists, engineers, and responders responsible for various components of Expel's product and services
- Provide access to popular EDR, network, SIEM, identity, and cloud technologies well beyond the Microsoft stack
- Challenge you to push the boundaries of our security vision
* * *
### **What you can do for Expel**
- Own our detection coverage across Defender XDR, Entra ID, Sentinel, Microsoft Graph, Azure, and Microsoft 365 — from raw signal through to shipped, tuned detections
- Build and maintain a living map of Microsoft security signal: what exists, known ingestion lag, where it lands, what gates it, how long it's kept, and how far you can trust it
- Track how that signal changes and turn every material change into a concrete action — catching drift before it costs us efficacy
- Tell us where Microsoft's native detections are strong enough to lean on, where they're noisy or shallow, and where Expel needs its own layer
- Make SOC analysts faster by automating Microsoft-specific investigative workflows against the Graph, Defender, Sentinel, and Entra APIs
- Partner with Engineering on our Microsoft integrations — ingestion, API limits and throttling, and schema mapping
- Answer the hard questions from the SOC, CS, and Sales — and mentor the people asking them
- Help customers understand what they're actually covered for, what they're missing, and what turning it on would buy them
* * *
### **What you should bring with you**
- Deep, current, hands-on knowledge of the Microsoft security stack — Defender XDR (Endpoint, Identity, Office 365, Cloud Apps), Entra ID, Sentinel, Microsoft Graph, and the Azure and Microsoft 365 control and data planes
- Fluency in KQL: you can write, read, optimize, and debug non-trivial hunting queries across both Defender Advanced Hunting and Sentinel, and you know how and why the two schemas differ
- Working knowledge of the Graph and Graph Security APIs, the Defender and Sentinel APIs, and their authentication, permission, versioning, and throttling models
- A strong grasp of the Entra ID (and legacy Active Directory) identity attack surface — authentication flows, conditional access, OAuth application consent, token theft and replay, hybrid identity and sync, privileged role abuse — and the telemetry each produces
- Solid understanding of Windows internals and command line tooling, with enough macOS and Linux to keep up with Defender's cross-platform coverage
- Experience writing, deploying, and tuning custom detections against Microsoft data sets, plus enough non-Microsoft exposure (AWS, GCP, other EDR and SIEM) to keep perspective
- Proficiency with Python and Sigma, and real fluency using Anthropic tools such as Claude Code to work across systems and data (locally, via MCP, and so on)
- 5+ years in information technology or security operations, with substantial time spent defending or operating Microsoft environments
- Excellent tact and diplomacy skills — you can explain Microsoft's limits to an audience that doesn't want to hear about them
- SC-200, AZ-500, or SC-300 are a plus; demonstrated depth matters considerably more
* * *
### **Work Location**
Our headquarters is in Herndon, Virginia. However, we realize that while there is a benefit to in-person interaction, good people don’t all live in Northern Virginia. Remote work is an option for this role.
* * *
### **Additional Notes**
The base salary range for this role is between $142,900 USD and $207,200 USD + bonus eligibility and equity. While the full salary band reflects our long-term compensation framework, we're primarily targeting candidates between $160,000 and $192,000 based on experience, skills, and market data.
We believe in paying transparently and equitably. Your salary will ultimately be based on factors such as your experience, skills, team equity, and market data. You’ll also be eligible for unlimited PTO (which we model and encourage), work location flexibility, up to 24 weeks of parental leave, and really excellent health benefits.
We’re only hiring those authorized to work in the United States. We do not currently sponsor immigration visas.
We’re an Equal Opportunity Employer: You’ll receive consideration for employment without regard to race, sex, color, religion, sexual orientation, gender identity, national origin, protected veteran status, or on the basis of disability.
We’ll ensure that individuals with disabilities are provided reasonable accommodation to participate in the job application or interview process, to perform essential job functions, and to receive other benefits and privileges of employment. Please let us know if you need accommodation of any kind.
#LI-Remote
Salary Range
$142,900—$207,200 USD