Senior Microsoft Detection & Response Architect

Expel; United States; Hybrid; USD 143,000 - 207,000; Full time

Benefits offered by this job

Remote work option

Competitive salary

Equity

Unlimited PTO

Parental leave

Excellent health benefits

Job summary

Expel is seeking a Detection Engineer to own our Microsoft security coverage, from Defender XDR to Entra ID and Graph APIs. You’ll write and tune detections against live signals, and translate complex telemetry into actionable guidance for customers and teams.

Remote-friendly role with collaboration across SOC, engineering, and data science. You’ll mentor peers, partner on integrations, and help expand Expel’s capabilities with advanced tooling and AI-assisted workflows.

Qualifications

• Deep knowledge of the Microsoft security stack including Defender XDR, Entra ID, Sentinel, Graph APIs, and Azure/M365 control planes.
• Fluency in KQL for hunting queries across Defender and Sentinel; understanding schema differences.
• Working knowledge of Graph and Defender/Sentinel APIs, authentication and throttling models.
• Strong Entra ID identity attack surface understanding and telemetry.
• Experience writing, deploying, and tuning detections against Microsoft data sets; exposure to AWS/GCP is a plus.
• Proficiency with Python and Sigma; experience with Claude Code for cross-system workflows.
• 5+ years in IT or security operations defending Microsoft environments.
• Excellent tact and diplomacy to explain Microsoft limits to diverse audiences.
• Certs like SC-200, AZ-500, SC-300 are a plus.

Responsibilities

• Own detection coverage across Defender XDR, Entra ID, Sentinel, Graph, Azure, and Microsoft 365.
• Build and maintain a living map of Microsoft security signal: ingestion lag, data lands, gates, retention, and trust.
• Track signal changes and translate into concrete actions to catch drift before efficacy is affected.
• Identify where native Microsoft detections are strong or insufficient; define Expel’s layer.
• Automate SOC investigations against Graph, Defender, Sentinel, and Entra APIs to speed analyst workflows.
• Partner with Engineering on integrations, ingestion limits, throttling, and schema mapping.
• Mentor teammates and address hard questions from SOC, CS, and Sales.
• Help customers understand coverage and missing capabilities and the value of enabling features.

Skills

Microsoft Defender XDR

KQL fluency

Graph APIs

Python

Sigma

Claude Code / Anthropic tools

Tools

Azure

AWS

GCP

SIEM integrations

Job description

Expel is seeking a Detection Engineer to own our Microsoft security coverage, from Defender XDR to Entra ID and Graph APIs. You’ll write and tune detections against live signals, and translate complex telemetry into actionable guidance for customers and teams.

Remote-friendly role with collaboration across SOC, engineering, and data science. You’ll mentor peers, partner on integrations, and help expand Expel’s capabilities with advanced tooling and AI-assisted workflows.