Microsoft Detection & Response Lead

Expel; United States; Remote; USD 143,000 - 207,000; Full time

Benefits offered by this job

Health benefits

Unlimited PTO

Remote-friendly

Job summary

Expel is seeking a detection engineer to own Microsoft coverage end to end. You will map real-world telemetry, determine ingestion points, and tune detections against Defender, Entra ID, and Graph with an emphasis on reliability and impact.

Remote-friendly role with a strong emphasis on cross‑team collaboration, mentoring, and customer-facing conversations. Requires 5+ years in IT/security and deep Microsoft ecosystem knowledge.

Qualifications

• Deep knowledge of the Microsoft security stack and Defender/Sentinel/Entra Graph platforms.
• Ability to write, optimize, and debug hunting queries in KQL across Defender and Sentinel.
• Experience integrating with Graph/Defender APIs and managing authentication and throttling.

Responsibilities

• Own detection coverage from raw signal to shipped detections across Defender XDR, Entra ID, Sentinel, Graph, Azure, and Microsoft 365.
• Build and maintain a living map of Microsoft security signals, ingestion lag, landing points, gates, and retention.
• Tune detections and automate investigative workflows across Microsoft data sets and non‑Microsoft data.
• Mentor teammates and answer hard questions from SOC, CS, and Sales about coverage and gaps.
• Collaborate with Engineering on integrations, API limits, and schema mapping.

Skills

Microsoft security stack

KQL

Graph APIs

Entra ID

Windows internals

Python

Sigma

Claude Code

Cloud providers

Diplomacy

Security certifications (SC-200/AZ-500

Education

Bachelor's degree in IT or Cybersecurity

Tools

Claude Code

PowerShell

Python

Microsoft Graph

Job description

Expel is seeking a detection engineer to own Microsoft coverage end to end. You will map real-world telemetry, determine ingestion points, and tune detections against Defender, Entra ID, and Graph with an emphasis on reliability and impact.

Remote-friendly role with a strong emphasis on cross‑team collaboration, mentoring, and customer-facing conversations. Requires 5+ years in IT/security and deep Microsoft ecosystem knowledge.