Senior Detection & Response Engineer
New
E
ExpelCybersecurity
Remote work is an option for this role.Full-TimeSenior
Salary$142,900 USD and $207,200 USD + bonus eligibility and equity
Apply NowOpens the employer's application page
Job Details
- Experience
- 5+ years in information technology or security operations
- Required Skills
- Python
Requirements
- 5+ years of experience in information technology or security operations.
- Hands-on expertise with Microsoft Defender XDR, Entra ID, Sentinel, Microsoft Graph, and Azure/M365 control planes.
- Advanced proficiency in KQL (Kusto Query Language) for writing and debugging complex hunting queries.
- Working knowledge of Microsoft security APIs and their authentication/throttling models.
- Strong understanding of identity attack surfaces including OAuth, token theft, and hybrid identity.
- Experience with Windows internals, command line tooling, and familiarity with macOS/Linux security.
- Demonstrated ability to write, deploy, and tune custom detections.
- Proficiency with Python, Sigma, and AI-assisted development tools like Claude Code.
- Experience with non-Microsoft security stacks (AWS, GCP) for broader perspective.
- Excellent communication skills for explaining technical constraints to internal and external stakeholders.
Responsibilities
- Own detection coverage across Defender XDR, Entra ID, Sentinel, Microsoft Graph, Azure, and Microsoft 365.
- Build and maintain a living map of Microsoft security signal including ingestion lags, data storage, and schema reliability.
- Track signal changes and proactively address drift to maintain detection efficacy.
- Automate Microsoft-specific investigative workflows against Graph, Defender, Sentinel, and Entra APIs.
- Partner with Engineering on Microsoft integration architecture, API management, and schema mapping.
- Answer technical inquiries from SOC, CS, and Sales teams and provide mentorship.
- Advise customers on their current security coverage, gaps, and potential improvements.
View Full Description & ApplyYou'll be redirected to the employer's site
